URL Logs from 2 weeks ago

weblogin — Mon, 11 Dec 2017 23:05:44 GMT

we currently installed a PA-3050.

i'm trying to do a URL search on our URL Filtering logs, but into goes far back as today.

i'm looking for something about 1 - 2 week ago. How do we do that.

thanks

Mark

Re: URL Logs from 2 weeks ago

reaper — Tue, 12 Dec 2017 10:18:36 GMT

Hi @weblogin

have you checked this article: Searching through logs, where do I start?

If you're using the methods outlined in the article and you're still only seeing 1 day worth of logs you may be logging so much that you ran out of log space and are overwriting old logs

you can verify your quota with

> show system logdb-quota

(URL logs are stored in the "threat" log database)

reaper@myNGFW> show system logdb-quota 

Quotas:
              system: 4.00%, 3.236 GB Expiration-period: 0 days
              config: 4.00%, 3.236 GB Expiration-period: 0 days
               alarm: 3.00%, 2.427 GB Expiration-period: 0 days
             appstat: 4.00%, 3.236 GB Expiration-period: 0 days
         hip-reports: 1.00%, 0.809 GB Expiration-period: 0 days
             traffic: 30.00%, 24.272 GB Expiration-period: 0 days
              threat: 16.00%, 12.945 GB Expiration-period: 0 days
        ...

Disk usage:
traffic: Logs and Indexes: 5.1G Current Retention: 581 days
threat: Logs and Indexes: 5.1G Current Retention: 1254 days

if your retention is 1 day (or very short) you may need to decrease logging by setting some benign web-categories to 'allow' instead of alert (allow does not log)

Or you may need to increase your quota if it is too small

topic Re: URL Logs from 2 weeks ago in General Topics

URL Logs from 2 weeks ago

Re: URL Logs from 2 weeks ago