topic Log System setting in General Topics

Log System setting

Shalev — Mon, 17 Jul 2023 05:10:52 GMT

I want to set up messages to be sent to email
I want every user who connects to the admin to receive an email no matter where the WAB or CLI or IP source comes from.

@filter builder

(severity eq informational) and (description contains 'logged in via WEB') or (description contains 'logged in via CLI')

This is what I configured Filter but only CLI works
Am I missing something?

I would appreciate your help.3

Re: Log System setting

PavelK — Mon, 17 Jul 2023 23:21:09 GMT

Hello @Shalev

thanks for posting.

To me it looks like there is an issue with upper/lower case. Could you change it to: "logged in via Web"?

Kind Regards

Pavel

Re: Log System setting

akuzhuppilly — Tue, 18 Jul 2023 08:50:05 GMT

Hello,

Change the filter to:

(severity eq informational) and (description contains 'logged in via Web') or (description contains 'logged in via CLI')

This should help.

Re: Log System setting

Shalev — Tue, 18 Jul 2023 09:51:54 GMT

This is not work

Re: Log System setting

PavelK — Tue, 18 Jul 2023 10:03:05 GMT

Hello @Shalev

could you post the screen shot with current filter you put in?

Kind Regards

Pavel

Re: Log System setting

Shalev — Tue, 18 Jul 2023 10:05:16 GMT

Re: Log System setting

akuzhuppilly — Tue, 18 Jul 2023 10:06:11 GMT

Hello,

I just checked this query from one of my firewalls and the results are as expected. You will need to login to the GUI and CLI to regenerate the alerts.

Re: Log System setting

Shalev — Tue, 18 Jul 2023 10:10:46 GMT

I exited and entered FW and I only have a notification about CLI and not about Wab

Re: Log System setting

Shalev — Tue, 18 Jul 2023 11:57:21 GMT

I succeeded
For general knowledge this is the command: (severity eq informational) and ( description contains 'logged in via Web from') or (description contains 'logged in via CLI')

Re: Log System setting

BPry — Tue, 18 Jul 2023 13:00:59 GMT

@Shalev,

A couple notes:

The filter you're using really should be grouped to the following "(severity eq informational) and ((description contains 'logged in via Web from') or (description contains 'logged in via CLI')). What you have is functional, but the search is logging for an informational event with 'logged in via Web from' in the description or any event with 'logged in via CLI' as presently written.
You don't need informational in this at all. You've targeted the description enough that you'll get your events regardless of that being included or not. It's just kind of extra at this point, it's not harming anything but it also isn't needed.