topic Firewall log decrease after R80.40 upgrade in Firewall and Security Management

Firewall log decrease after R80.40 upgrade

ykpark — Mon, 05 Sep 2022 00:05:35 GMT

Dear all,

The customer upgraded the version of the firewall and management server from R80.30 to R80.40.

They said that the log events decreased after the version upgrade.
Customers report that the average daily fw log for the firewall has decreased from 35 million to 13,000.

(All upgraded firewalls are showing the same problem.)

Too many differences have occurred. We want to find out why this number of fw log has decreased.

Please advise if you have had a similar problem to us or how to find this problem.

Thanks

Re: Firewall log decrease after R80.40 upgrade

Chris_Atkinson — Mon, 05 Sep 2022 06:44:05 GMT

How much disk space is available, are the raw log files there and it's just an indexing issue?

sk167511: Log indexing is delayed after an upgrade to R80.40

If you have the latest Jumbo applied might be worth discussing your symptoms with TAC.

Re: Firewall log decrease after R80.40 upgrade

ykpark — Mon, 05 Sep 2022 08:17:17 GMT

Hi,

Thank you for your answer.

It is being sent to the log server using the log export function.
Could it be an issue with log server delivery if there is an issue with indexing lag?

Thanks.

Re: Firewall log decrease after R80.40 upgrade

Chris_Atkinson — Mon, 05 Sep 2022 12:16:53 GMT

So to clarify are the logs there on the CP Mgmt/Log server they just aren't being received at the SIEM end in the same volumes as before?