-f [-t]

After reaching the end of the currently displayed file, do not exit (the default behavior), but continue to monitor the Log file indefinitely and display it while it is being written.

The -t parameter indicates that the display is to begin at the end of the file, in other words, the display will initially be empty and only new records added later will be displayed.

-t must come with a -f flag. These flags are relevant only for active files.

-n

Do not perform DNS resolution of the IP addresses in the Log file (the default behavior). This option significantly speeds up the processing.

-l

Display both the date and the time for each log record (the default is to show the date only once above the relevant records, and then specify the time per log record).

-o

Show detailed log chains (all the log segments a log record consists of).

-c <action>

Display only events whose action is action, that is, accept, drop, reject, authorize, deauthorize, encrypt and decrypt. Control actions are always displayed.

-h <host>

Display only log whose origin is the specified IP address or name.

-s <starttime>

Display only events that were logged after the specified time (see time format below). starttime may be a date, a time, or both. If date is omitted, then today's date is assumed.

-e <endtime>

Display only events that were logged before the specified time (see time format below). endtime may be a date, a time, or both.

-b <starttime> <endtime>

Display only events that were logged between the specified start and end times (see time format below), each of which may be a date, a time, or both. If date is omitted, then today's date is assumed. The start and end times are expected after the flag.

-u <unification_scheme_file>

Unification scheme file name.

-m

This flag specifies the unification mode.

• initial - the default mode, specifying complete unification of log records; that is, output one unified record for each id. This is the default.
  When used together with -f, no updates will be displayed, but only entries relating to the start of new connections. To display updates, use the semi parameter.
• semi - step-by-step unification, that is, for each log record, output a record that unifies this record with all previously-encountered records with the same id.
• raw - output all records, with no unification.

-a

Output account log records only.

-k {<alert_name>|all}

Display only events that match a specific alert type. The default is all, for any alert type.

-g

Do not use a delimited style. The default is:

• : after field name
• ; after field value

logfile

Use logfile instead of the default Log file. The default Log File is $FWDIR/log/fw.log.