Log System setting

[Shalev]

I want to set up messages to be sent to email Log Settings - Config 
I want every user who connects to the admin to receive an email no matter where the WAB or CLI or IP source comes from.

@filter builder

(severity eq informational) and (description contains 'logged in via WEB') or (description contains 'logged in via CLI')

This is what I configured Filter but only CLI works
Am I missing something?

I would appreciate your help.3

[PavelK]

Hello @Shalev

thanks for posting.

To me it looks like there is an issue with upper/lower case. Could you change it to: "logged in via Web"?

Kind Regards

Pavel

[akuzhuppilly]

Hello,

Change the filter to:

(severity eq informational) and (description contains 'logged in via Web') or (description contains 'logged in via CLI')

This should help.

[Shalev]

This is not work

[PavelK]

Hello @Shalev

could you post the screen shot with current filter you put in?

Kind Regards

Pavel

[Shalev]

[akuzhuppilly]

Hello,

I just checked this query from one of my firewalls and the results are as expected. You will need to login to the GUI and CLI to regenerate the alerts.

[Shalev]

I exited and entered FW and I only have a notification about CLI and not about Wab

[Shalev]

I succeeded
For general knowledge this is the command: (severity eq informational) and ( description contains 'logged in via Web from') or (description contains 'logged in via CLI')

[BPry]

@Shalev,

A couple notes:

• The filter you're using really should be grouped to the following "(severity eq informational) and ((description contains 'logged in via Web from') or (description contains 'logged in via CLI')). What you have is functional, but the search is logging for an informational event with 'logged in via Web from' in the description or any event with 'logged in via CLI' as presently written.
• You don't need informational in this at all. You've targeted the description enough that you'll get your events regardless of that being included or not. It's just kind of extra at this point, it's not harming anything but it also isn't needed.