Traffic Log Search Syntax

[paloVerzion]

What would be the syntax used to create a filter for Traffic logs where one wants to display all traffic initiating or terminating from/to addresses a pre-defined "address-group" ?

[ybommakanti]

Hello,

This option is currently not available.There is no way to filter the logs using predefined address objects as the filters will query against the traffic log database which contains logs with ip addresses and not address objects .You can try filtering using a combination of source or destination IP-addresses to achieve this.

Hope this helps.

Yashwanth

[paloVerzion]

Yashwanth A Happy New Year to you!
Thanks for the reply, I was rapidly (well not so rapid) coming to this conclusion...However, having once created the "address" and "address-group" entries is seems a shame to not to be able to use them in certain situations...
A feature request possibly?

Regards

Luke

[JohnPetrucci]

Understandable that the log records contain the IP and not the group, but why can't the firewall log viewer accept a group object as input and dynamically create a filter (containing all the inherited IP addresses) in the background?

[panos]

this is something has to be improved.

why can't ? maybe it's about code.