the directory for log files is Linux-like: "/var/log/". There you find the log files and the archieved log files (*-date.gz). To list actual logs type "ls -l | grep -v gz".To view a file type e.g. "tail kernel | grep "searchpattern like IP"". The file "kernel" shows packet drops. But: nightly at 00:00 o´clock the files are archieved and g´zipped. The name of the archieve is then: filename-date.gz You have to extract them before viewing (for example "tar xvzf "filename-date.gz"").
Livelog works well, but does not say which rule number was used to kill the packet off... This feature would be worth it, since so many times I have spent a long time attempting to work out why a packet was dying...
I believe that the packet logging does save the rule number when killing off - but having thought about this I am not sure how useful this will be since ASTARO redirects DROP packets to another rule to kill them off.
Thinking out loud again, you can monitor the counters on each of the rules and chains but that is hard on a big firewall
Checking out he logs in the manner described above works but I feel that Webadmin should provide the functionallity to extract and view logs of previous dates.
