Viewing Security Logs

The Logs & Monitoring > Logs > Security Logs page shows the last 100 log records.

To load more records, continue scrolling down the page. The log table is automatically refreshed.

Enter your query in the Enter search query search field on the right side of the screen and click the search icon .

If you require assistance to create a query:

  1. Click the Query Syntax icon next to the search field.

  2. The Query Syntax window opens and shows examples for:

    • General Search - A simple string or an IP address.

      Example: 203.0.113.64

    • Focused Search - <Field-Name>:<criteria>. The Field Name can be the name of a table column or a field from the log details.

      Example: action:drop or source port:22

    • You can use operators in your search. Examples:

      [NOT] text1 AND [NOT] text2 … AND [NOT] textn

      [NOT] text1 OR [NOT] text2 … OR [NOT] textn

      [NOT] field1:value1 AND [NOT] field2:value2 … AND [NOT] fieldn:valuen

      [NOT] field1:value1 OR [NOT] field2:value2 … OR [NOT] fieldn:valuen

Notes:

  • Search is not case-sensitive.

  • Make sure there is no space between the field name and the search criteria.

To limit the number of logs to search:

  1. Click the Settings tab.

  2. In the Security Logs Settings window, select the checkbox Limit the number of logs to search.

  3. In the Maximum number of logs to search field, use the arrows to select the desired number.

  4. Click Save.

  1. Select a log entry from the list.

  2. Click View Details or double-click the entry.

    The log record opens.

Click the Refresh icon .

To stop local logging:

When necessary, you can stop local logging for better performance. This removes the overhead of creating and maintaining logs. No new logs are generated until you set the resume option.

  1. Select Actions > Stop local logging.

  2. To resume, select Actions > Resume local logging.

    Note - In version R81.10.08 and lower, select Options instead of Actions.

Logs can be stored locally on the appliance's non-persistent memory or on an external SD card (persistent). Logs can also be sent to an externally managed log server (see Log Servers page).

When you insert an SD card, it mounts automatically and then local logs are saved to it. Before you eject an SD card, make sure to unmount it. Select Actions > Eject SD card safely.

Note - In firmware versions R81.10.00 and higher, SD cards are formatted with the ext4 file system. In older firmware versions, SD cards are formatted with the FAT32 file system. If you upgrade to a version R77.20.85 or higher, the file system on the SD card remains FAT32 for backward compatibility.

 

  1. In Logs & Monitoring > Logs > Security Logs page, click Clear logs.

    A confirmation window opens.

  2. Click Yes to delete logs.

    The logs are deleted, and the logs grid reloads automatically.

Note - Logs are deleted from the external SD card (if inserted) or from the local logs storage. Logs are not deleted from the remote logs server.

The logs are deleted, and the logs grid reloads automatically.

To export the security logs, see Configuring External Log Servers.