topic Re: search in log for "PenaltyBox" not possible in Firewall and Security Management

search in log for "PenaltyBox" not possible

Wolfgang — Fri, 28 May 2021 13:17:42 GMT

Hello CheckMates,

it's not possible to search in logs for entries blocked by PenaltyBox-feature (fwaccel dos pbox...)

Search for "Penalty" or "DOS" brings no results. Looks like these fields are not indexed ?

Why not? Every shown field should be searchable.

Any way to find these logs without to know the source IP ?

Re: search in log for "PenaltyBox" not possible

PhoneBoy — Fri, 28 May 2021 15:30:45 GMT

Not every log field is indexed is for performance reasons.
That does make certain logs…harder to find.

Re: search in log for "PenaltyBox" not possible

HeikoAnkenbrand — Fri, 28 May 2021 15:49:13 GMT

Hi @Wolfgang,

Not all fields in SmartLog are displayed in the console. In sk144192 there are more log fields described that you can use.

Maybe the following fields can help:
- securexl_message

Re: search in log for "PenaltyBox" not possible

Wolfgang — Fri, 28 May 2021 19:30:02 GMT

@HeikoAnkenbrand and @PhoneBoy

No chance at all. None of the shown fields "SecureXL Message", "comment" or "Feature Name" is available to a filter.

Same in old Logviewer.

I'm not happy that you had no chance to find an information if the PenaltyBox is detecting something 😞

Re: search in log for "PenaltyBox" not possible

Wolfgang — Tue, 01 Jun 2021 18:35:02 GMT

small update….

With R81 the comment field is searchable. Now you can search „penalty box“ and there are results shown 😀

Re: search in log for "PenaltyBox" not possible

PhoneBoy — Wed, 02 Jun 2021 04:22:38 GMT

I suspect there were some "under the hood" changes in R81 given you have to reindex all the logs when you upgrade.
Also, an interesting tidbit in the R81.10 EA release notes: The Solr functionality is replaced with a PostgreSQL database to improve the stability and performance of the Security Management Server.
Which means: more under the hood changes are coming 🙂

Re: search in log for "PenaltyBox" not possible

olliM — Tue, 08 Jun 2021 10:26:36 GMT

Hi Wolfgang,

we had the same issue with R80.x. Because there was no solution for that, i tested some filter combinations and found a workaround.

Using the following filter to display the needed infos in logs:

(type:"Alert") and not (src:"ips of your internal network" or dst:"your ips from external networks")

It may be necessery to select or edit the correct profile for displaying the field "Firewall Message" in the logging table.

Re: search in log for "PenaltyBox" not possible

CheckPointerXL — Mon, 06 Jun 2022 14:15:45 GMT

you can try with "penalty box"