topic Re: LOGS in General Topics

LOGS

Satish — Thu, 24 Jul 2014 16:53:37 GMT

Hi Friends,

Please share the best practice for logs checking. how can iden

Re: LOGS

hshah — Thu, 24 Jul 2014 16:58:21 GMT

Hi Satish,

By default logs are generated at the end of session. You can find logs at Monitor > Traffic or any other category.

Let me know if you need additional information.

Regards,

Hardik Shah

Re: LOGS

HULK — Thu, 24 Jul 2014 17:03:26 GMT

Hello Satish,

If you want to see logs for troubleshooting/monitoring purpose, then Monitor >logs will help you for the same. You may also check ACC report for all traffic/threat related activity. To generate logs report for audit/database/analysis, follow mentioned discussion:

Reports

Thanks

Re: LOGS

HULK — Thu, 24 Jul 2014 17:22:54 GMT

Related doc: Session Log Best Practice

Thanks

Re: LOGS

Satish — Thu, 24 Jul 2014 17:25:13 GMT

Hi Hardik and Hulk,

my question is that how to find any network traffic log for make correct policy or identity for particular log for per user/ ip / port ... etc.thanks

Re: LOGS

hshah — Thu, 24 Jul 2014 17:26:48 GMT

Hi Satish,

You can find that with Monitor > Log > traffic, based on trial and error method you will get idea.

Regards,

Hardik Shah

Re: LOGS

Satish — Thu, 24 Jul 2014 17:35:16 GMT

Thanks Hardik,

let me check and i will get back to you.

Regards

Satish

Re: LOGS

HULK — Thu, 24 Jul 2014 17:37:59 GMT

Otherway, if there is an Active session exist on the firewall, you may grab the session ID and see detailed info as mentioned below:

> show session all filter source x.x.x.x destination y.y.y.y

9936 dns ACTIVE FLOW NS 100.100.100.1[53621]/trust-L3/17 (1.1.1.2[43506])

vsys1 8.8.8.4[53]/untrust-L3 (8.8.8.4[53])

admin@31-PA-3020> show session id 9936

Session 9936

c2s flow:

source: 100.100.100.1 [trust-L3]

dst: 8.8.8.4

proto: 17

sport: 53621 dport: 53

state: ACTIVE type: FLOW

src user: plano2003\csharma >>>>>>>>>>>>>>> Source User

dst user: unknown

s2c flow:

source: 8.8.8.4 [untrust-L3]

dst: 1.1.1.2

proto: 17

sport: 53 dport: 43506

state: ACTIVE type: FLOW

src user: unknown

dst user: plano2003\csharma

start time : Thu Jul 24 12:33:04 2014

timeout : 30 sec

time to live : 12 sec

total byte count(c2s) : 240

total byte count(s2c) : 0

layer7 packet count(c2s) : 3

layer7 packet count(s2c) : 0

vsys : vsys1

application : dns

rule : trust-to-untrust >>>>>>> Security rule

session to be logged at end : True

session in session ager : True

session synced from HA peer : False

address/port translation : source + destination

nat-rule : nat-inside-2-outside(vsys1) >>>>>>>>>>>>>> NAT policy name

layer7 processing : enabled

URL filtering enabled : True

URL category : any

session via syn-cookies : False

session terminated on host : False

session traverses tunnel : True

captive portal session : False

ingress interface : tunnel.1 >>>>>>>>>>>>>> Incoming interface

egress interface : ethernet1/3 >>>>>>>>>>>>>>>> Outgoing interface

session QoS rule : N/A (class 4)

Thanks