topic Re: Traffic Log Search Syntax in General Topics

Traffic Log Search Syntax

paloVerzion — Wed, 01 Jan 2014 09:21:38 GMT

What would be the syntax used to create a filter for Traffic logs where one wants to display all traffic initiating or terminating from/to addresses a pre-defined "address-group" ?

Re: Traffic Log Search Syntax

ybommakanti — Wed, 01 Jan 2014 13:58:25 GMT

Hello,

This option is currently not available.There is no way to filter the logs using predefined address objects as the filters will query against the traffic log database which contains logs with ip addresses and not address objects .You can try filtering using a combination of source or destination IP-addresses to achieve this.

Hope this helps.

Yashwanth

Re: Traffic Log Search Syntax

paloVerzion — Fri, 03 Jan 2014 12:13:48 GMT

Yashwanth A Happy New Year to you!
Thanks for the reply, I was rapidly (well not so rapid) coming to this conclusion...However, having once created the "address" and "address-group" entries is seems a shame to not to be able to use them in certain situations...
A feature request possibly?

Regards

Luke

Re: Traffic Log Search Syntax

JohnPetrucci — Wed, 01 Oct 2014 19:19:36 GMT

Understandable that the log records contain the IP and not the group, but why can't the firewall log viewer accept a group object as input and dynamically create a filter (containing all the inherited IP addresses) in the background?

Re: Traffic Log Search Syntax

Retired Member — Wed, 01 Oct 2014 19:36:26 GMT

this is something has to be improved.

why can't ? maybe it's about code.