topic Re: Is there a log filters quick reference? in General Topics

Is there a log filters quick reference?

PotStirrer — Fri, 19 Jul 2013 00:29:55 GMT

Is there a log filters quick reference?

Re: Is there a log filters quick reference?

cchristiansen — Fri, 19 Jul 2013 01:26:15 GMT

Are you refering to the GUI or command line? In the GUI, you can click the "?" at the end of the search line and it will give you information about viewing logs. Also in the GUI, you can click any of the clickable enties within a column and it will put that filter up in the search field for you. It will always add the next filter as an "and", but if you want, you can change that "and" to "or" if that fits your intended query better. As for the CLI, you can download the cli guide from the support.paloaltonetworks website for the version of PAN-OS you are running. You can also just use the "?" on the CLI as well. For example:

admin@PA-200> show session all filter ?

+ application Application name

+ count count number of sessions only

+ destination destination IP address

+ destination-port Destination port

+ destination-user Destination user

+ egress-interface egress interface

+ from From zone

+ hw-interface hardware interface

+ ingress-interface ingress interface

+ min-kb minimum KB of byte count

+ nat If session is NAT

+ nat-rule NAT rule name

+ pbf-rule Policy-Based-Forwarding rule name

+ protocol IP protocol value

+ qos-class QoS class

+ qos-node-id QoS node-id value

+ qos-rule QoS rule name

+ rematch rematch sessions

+ rule Security rule name

+ source source IP address

+ source-port Source port

+ source-user Source user

+ ssl-decrypt session is decrypted

+ start-at Show next 1K sessions

+ state flow state

+ to To zone

+ type flow type

| Pipe through a command

<Enter> Finish input

admin@PA-200> show session all filter

Hope this helps answer your question. If not, please be more specific and I will try and get you the information you need.

-chadd.

Re: Is there a log filters quick reference?

cchristiansen — Fri, 19 Jul 2013 01:32:04 GMT

Also, if you want to search all the logs from the command line you have this option:

admin@PA-200> show log data

+ action action

+ app app

+ category category

+ csv-output csv-output

+ direction direction

+ dport dport

+ dst dst

+ dstuser dstuser

+ end-time end-time

+ from from

+ query query

+ receive_time receive_time

+ rule rule

+ sport sport

+ src src

+ srcuser srcuser

+ start-time start-time

+ suppress-threatid-mapping suppress-threatid-mapping

+ to to

| Pipe through a command

<Enter> Finish input

admin@PA-200> show log data