Length of WAF log file

Hi MDR,

I am not really sure about this, can you tell us how did you verify that length?

Thanks

I simply checked the line length with notepad++

You can see that a line started on line 1 is continued on line 2 when it exceeds 1075 characters.

For instance it cuts of a URL from line 1 and continues on line 2

Hi MDR,

It simply makes things readable. I am not sure what difference will that make if the lines are not truncated. If you have a better IDEA for this feature, please share it here.

Thanks

The difference is huge , since I forward the logs to a SIEM , who needs to be able to interpret the logs correctly

Hi, MDR, and welcome to the UTM Community!

Have you tried using the Remote Syslog Server capability to see if the lines are complete when not written to a UTM log file?

Cheers - Bob

Hi Bob ,

Yes , I observe exactly the same truncate in the UTM log and the remote syslog.

(The Syslog is forwarded remotely to our SIEM.)

PS : I suppose everyone has this limitation ?

Kind regards.

Michel

Michel, I would urge you to get a ticket opened with Sophos Support if you have a paid license.  In any case, you might want to check to see if there is a suggestion you can vote for and comment on in Ideas - or make one yourself.

Cheers - Bob

I understand now why is that required. If possible open a case with Support and raise it as a feature on ideas(mentioned previously).

Thanks

I am a bit surprised that I am the sole in community to struggle with this problem.

I thought someone of community could help me.

In the meantime I opened a ticket via my distributor.

Kind regards

I think this a limitation of the underlying syslog protocol that WAF uses for logging. Each log message must be 1024 characters or less, longer log messages must be split. The syslog daemon than adds a timestamp and other stuff when it writes the log message to the log file, which results in the maximum 1075 characters per log line in reverseproxy.log that you see.