topic Re: smartview monitor and smartview logs didnt match in Firewall and Security Management

smartview monitor and smartview logs didnt match

cathychan — Mon, 07 Aug 2023 07:26:12 GMT

Hello Guys, I have a question about our monitoring tools, on smartview I am seeing a huge spike on SRC and DEST. however, when I check on smartview logs I didnt see the logs for it

example

Smartview monitor shows 60Gbps of traffic spike for SRC A and DEST B.

when I review the logs on smartview logs this connection didnt show up.

Note: we have a specific rule that allows the connection.

Any reasons you know why?

thank you!

Re: smartview monitor and smartview logs didnt match

_Val_ — Wed, 09 Aug 2023 05:07:29 GMT

How did you search?

Re: smartview monitor and smartview logs didnt match

_Val_ — Wed, 09 Aug 2023 05:13:17 GMT

It seems to me, you are missing a font or two, so they do not render.

Re: smartview monitor and smartview logs didnt match

cathychan — Thu, 10 Aug 2023 07:43:37 GMT

thank you Val for response, can you share what do you mean by Font 😄 Im sorry I am new.. If you mean filter.. what I did is

origin: FWCluster

Source: SOURCEIP

port: 2049

I check on the statistics no logs for the destination I am looking to but I can definitely see it on monitor and also on packet capture.

thank you!

Re: smartview monitor and smartview logs didnt match

_Val_ — Thu, 10 Aug 2023 07:55:01 GMT

Sorry, I though I was answering a different thread, disregard the fonts 🙂

Re: smartview monitor and smartview logs didnt match

_Val_ — Thu, 10 Aug 2023 07:56:05 GMT

So, my understanding is, you cannot find logs for certain connections. Do you log all rules?

Re: smartview monitor and smartview logs didnt match

cathychan — Thu, 10 Aug 2023 08:06:17 GMT

yes we do log all rules.. for some reason only this is not logged 😕

Re: smartview monitor and smartview logs didnt match

PhoneBoy — Wed, 23 Aug 2023 21:12:58 GMT

Is it a continually active connection (i.e. no TCP FIN/RST) or one that terminates/re-establishes?
If it's continually active, then you will only find a single log entry for the original connection establishment with the bytes updated on that log entry.