Policy with "Log at Session Start" option - how to find it?

[_slv_]

Hello

I have about 100 polices on my device, some of them has "Log at Session Start" option enabled. Is it posisible to find it from the CLI ?

I have very little skills in CLI so please give me the whole CLI command.

I realised that my weekly reports are unusable because I have only data from last few days. How I can save some space on PA200 to get more logs than last 7 days?

With regards

SLawek

[UhMayYeah]

Pre-requisite: Text-Editors like Notepad ++ or PSPad

Method:

Enable Logging for  CLI session from the Terminal Application eg Putty.

CLI Commands:

> set cli pager off

> set cli config-output-format set

> configure

# show rulebase security

Open  CLI session log and Find-All for the string "log-start yes"

[ACieszkowski]

Our you could just export whole configuration to XML file and search it.

Considering log size - look at what you are logging. Some chatty protocols (example: DNS) are not always worth logging, think about updates (adobe-update, ms-update) and so on.

Look into ACC, sorting by sessions, at applications. Search for those that you are willing to "sacrifice", disable logging for them.

[emr_1 · Accepted solution]

Hello,

Please use following filter in security rule page (on GUI).

(log-start eq 'yes')

You can change log storage allocation under device tab > setup > management tab > logging and reporting settings

please click edit button on the right upper corner.

Regards,

[_slv_]

Your solution is correct but EMR's solution is much simplier so points must go to EMR.

Thank you to all of you for your help.

With regards

SLawek

[ACieszkowski]

emr - Is there any guide for Security Rules filters?

[emr_1]

I don't know there is any document related to this filter, but I found this filter from PaloAlto API browser and debug for web browser.

You can access to API browser by typing in https://<IP address for MGT>/api/

For debug, you can access to https://<IP address for MGT>/debug

Regards,

[mikand]

I think you must be superadmin to gain access to the /debug page.