review cached URL continue challenge entries

[jogyulas]

Hi Guys,

according to below article URL entries is cached for users per category.
is it possible to check cached entries per user/URL/category to see current state?

Continue Action in URL filtering not working as expected 

Thanks,

[Remo]

Hi @jogyulas 

There is nothing like a specific CLI command that will show you directly what you are asking for. 

But in monitor tab it is actually pretty easy to filter exactly for this information. As a base filter simply add "(action eq block-continue)". In addition to that you can specify the url category or the user you want to check and if you direcrly want to see only the entries in the cache currently, then add an additional filter for time_generated with a greaterequal (geq) and the time in the past with the current time minus the timeout you configured on the firewall. The result is a view that only shows you the current entries (as long as the user clicked the continue button - otherwise unfortunately there will be many logs with action block-continue).

... at least a beginning about where to get the information you mentionned.