topic Re: Policy with "Log at Session Start" option - how to find it? in General Topics

Policy with "Log at Session Start" option - how to find it?

_slv_ — Mon, 22 Jul 2013 07:10:15 GMT

Hello

I have about 100 polices on my device, some of them has "Log at Session Start" option enabled. Is it posisible to find it from the CLI ?

I have very little skills in CLI so please give me the whole CLI command.

I realised that my weekly reports are unusable because I have only data from last few days. How I can save some space on PA200 to get more logs than last 7 days?

With regards

SLawek

Re: Policy with "Log at Session Start" option - how to find it?

UhMayYeah — Mon, 22 Jul 2013 14:38:24 GMT

Pre-requisite: Text-Editors like Notepad ++ or PSPad

Method:

Enable Logging for CLI session from the Terminal Application eg Putty.

CLI Commands:

> set cli pager off

> set cli config-output-format set

> configure

# show rulebase security

Open CLI session log and Find-All for the string "log-start yes"

Re: Policy with "Log at Session Start" option - how to find it?

Retired Member — Mon, 22 Jul 2013 15:52:05 GMT

Our you could just export whole configuration to XML file and search it.

Considering log size - look at what you are logging. Some chatty protocols (example: DNS) are not always worth logging, think about updates (adobe-update, ms-update) and so on.

Look into ACC, sorting by sessions, at applications. Search for those that you are willing to "sacrifice", disable logging for them.

Re: Policy with "Log at Session Start" option - how to find it?

emr_1 — Tue, 23 Jul 2013 02:16:20 GMT

Hello,

Please use following filter in security rule page (on GUI).

(log-start eq 'yes')

You can change log storage allocation under device tab > setup > management tab > logging and reporting settings

please click edit button on the right upper corner.

Regards,

Re: Policy with "Log at Session Start" option - how to find it?

_slv_ — Tue, 23 Jul 2013 07:45:47 GMT

Your solution is correct but EMR's solution is much simplier so points must go to EMR.

Thank you to all of you for your help.

With regards

SLawek

Re: Policy with "Log at Session Start" option - how to find it?

Retired Member — Tue, 23 Jul 2013 08:03:52 GMT

emr - Is there any guide for Security Rules filters?

Re: Policy with "Log at Session Start" option - how to find it?

emr_1 — Tue, 23 Jul 2013 08:08:01 GMT

I don't know there is any document related to this filter, but I found this filter from PaloAlto API browser and debug for web browser.

You can access to API browser by typing in https://<IP address for MGT>/api/

For debug, you can access to https://<IP address for MGT>/debug

Regards,

Re: Policy with "Log at Session Start" option - how to find it?

mikand — Tue, 23 Jul 2013 19:44:02 GMT

I think you must be superadmin to gain access to the /debug page.