topic Re: How to determine uptime intervals from gateway logs? in Firewall and Security Management

How to determine uptime intervals from gateway logs?

Vladimir — Sat, 04 Nov 2017 12:54:05 GMT

Does anyone know if there is a way to extract the history of boot and shutdown dates and times from R80.10 vSEC instances?

Re: How to determine uptime intervals from gateway logs?

PhoneBoy — Mon, 06 Nov 2017 19:51:46 GMT

Here's what I see in my vSEC instances in AWS.

These gateways are set up in an autoscaling group and are created/destroyed using an Ansible playbook.

Your mileage may vary.

Re: How to determine uptime intervals from gateway logs?

Vladimir — Mon, 06 Nov 2017 20:19:59 GMT

Thanks,

Unfortunately, this will not work for me: I have number of vSECs non-AG that are periodically powered-up or down, but the management server itself suffered failure and was restored from the snapshot.

Hence this headache. Do you know if there are any events pertaining to power-up/down logged on the gateways themselves?

Re: How to determine uptime intervals from gateway logs?

PhoneBoy — Mon, 06 Nov 2017 20:29:14 GMT

Every Unix-like system will have tell-tale signs of a reboot in /var/log/messages.

I believe by default we keep 5 days worth of messages.

And there's obviously the "uptime" command on each gateway which will tell you when it was last rebooted.

Re: How to determine uptime intervals from gateway logs?

PhoneBoy — Mon, 06 Nov 2017 20:30:26 GMT

I think what you are after might be in $FWDIR/log/fwd.elg, though...

Re: How to determine uptime intervals from gateway logs?

Vladimir — Mon, 06 Nov 2017 20:58:01 GMT

native will not work, as I am looking for about a month and a half of halt/powerup events.

Same issue is with "uptime", as it only shows the current value.

Re: How to determine uptime intervals from gateway logs?

Vladimir — Mon, 06 Nov 2017 20:58:49 GMT

fwd.elg does not contain the timestamps.

bummer...

Re: How to determine uptime intervals from gateway logs?

Hugo_vd_Kooij — Tue, 07 Nov 2017 10:04:18 GMT

Unfortunatly the default values may not work to well. I recommend to:

Increase the number of backup files and the size of each Messages file. sk36798
If you get bogus input like missing RAID disks. Find the cause and make sure it is no longer send to the messages file when it is not needed.

And I strongly recommend to send your syslog to a central log server.

Re: How to determine uptime intervals from gateway logs?

Vladimir — Tue, 07 Nov 2017 13:39:34 GMT

Thank you.

This is a one-off situation. I've build a bunch of AWS scenarios intended to be a proof of concept, but am now in a position to bill the client for the time spend on it.

Under normal circumstances, (i.e. in production), I'll be using an AWS Cloud Trail to have this info readily available. But since it was not configured from the get-go, I was trying to determine if there are CP specific logs with this data.

Alas, I'll have to estimate time spent on the project without supporting documentation, which I really dislike doing.