topic cp_log_export syslog config Filter FilterConfiguration.xml in Firewall & Security Management

cp_log_export syslog config Filter FilterConfiguration.xml

Support_Effia — Wed, 30 Jun 2021 15:23:56 GMT

Hi,

I want to use the file FilterConfiguration.xml and only export log from only one GW.

For that I want to use the filed name origin_sic_name

My file is look like that:

<filters> <filterGroup operator="and"> <field name="action" operator="and"> </field> <field name="origin" operator="and"> </field> <field name="product" operator="and"> </field> </filterGroup> <filterGroup operator="and"> <filed name="origin_sic_name" operator="and"> <value operation="eq">CN=NAMEOFFW</value> </filed> </filterGroup> </filters>

But it do not work and export all logs from our smartLog...

Can you help me please?

Regards.

Re: cp_log_export syslog config Filter FilterConfiguration.xml

PhoneBoy — Sat, 03 Jul 2021 00:32:29 GMT

I'm guessing the SIC name will be the full DN as listed in the SIC status of the relevant gateway object.
Why use that versus origin with the just the simple gateway object name?

Re: cp_log_export syslog config Filter FilterConfiguration.xml

genisis__ — Sat, 03 Jul 2021 12:59:14 GMT

I've done something like this where I exported only ThreatPrevention logs for specific gateways.

cp_log_export set name <LogServer> domain-server <DMS1> filter-blade-in "TP" filter-origin-in "a.a.a.a,b.b.b.b,c.c.c.c"
Note: The above adds entries into $EXPORTERDIR/targets/<name>/conf/FilterConfiguration.xml