topic Need help with SmartConsole in Firewall and Security Management

Need help with SmartConsole

HristoGrigorov — Wed, 09 Dec 2020 06:19:54 GMT

Hello,

I have two questions regarding smart console (R80.40):

1. How do I reverse log query by time? I mean if I want to see what was the first time matching entry was logged in, for example within the Last 7 Days how do I do it, without some long and painful scrolling of course ?

2. Why am I not able to copy time cell to clipboard ? It seems to work for all other cells but not this one.

Thanx in advance.

Re: Need help with SmartConsole

PhoneBoy — Wed, 09 Dec 2020 21:30:02 GMT

Using SmartView (instead of SmartConsole) might fix the second issue, but for the first, you might have to open up SmartView Tracker to do that one more efficiently.
Question is: why is that relevant?

Re: Need help with SmartConsole

HristoGrigorov — Thu, 10 Dec 2020 03:21:31 GMT

Hmm, if you ask me about what is the use case here, how about this:

1. My boss asked me what time exactly his laptop started to flood our active directory with ldap requests? I could not give answer in a sensible time and had to scroll for a long time day by day to find out. Not very pleasant if you ask me.

2. Being able to copy all but one cell gives me the impression software is "incomplete" unless there is a technical explanation why it is not possible.

Re: Need help with SmartConsole

PhoneBoy — Thu, 10 Dec 2020 03:35:00 GMT

Well...that is an interesting use case. 🙂
At some point, SmartView was supposed to replace what was in SmartConsole and you should be able to copy/paste that cell from there.

Re: Need help with SmartConsole

HristoGrigorov — Thu, 10 Dec 2020 04:06:37 GMT

Can't do it in SmartView either, just tried. Only way is to double click on the record and copy from pop-up window. Not very convenient but does the job.

Re: Need help with SmartConsole

ED — Thu, 10 Dec 2020 08:30:45 GMT

Hi Hristo,

You can try this. It's not a perfect solution but at least it will save you some scrolling 🙂

Mark a log and then press either "Page Down" on your keyboard to get to the bottom and "Page Up" the other way. Keep holding one of the keys till you get to the bottom (might take a while 🙂 )

The perfect solution would be to have the "Home" and "End" function as the top and bottom button. Or being able to click on the "Time" column and sort by time, just like in Excel.

Re: Need help with SmartConsole

HristoGrigorov — Thu, 10 Dec 2020 08:50:04 GMT

@ED Thanx, my thoughts exactly. Although, I would be happy with export in Excel also but sadly that's not available ☹️

Re: Need help with SmartConsole

ED — Thu, 10 Dec 2020 09:01:12 GMT

Have you tried this?

Re: Need help with SmartConsole

Borut — Thu, 10 Dec 2020 09:02:27 GMT

You can export the logs to CSV by clicking the 3 line icon next to search box and chose File -> Export to Excel CSV...

I believe, all the relevant logs in the selected timeframe are exported.

Re: Need help with SmartConsole

HristoGrigorov — Thu, 10 Dec 2020 09:09:47 GMT

@Borut Thanx, that would be perfect but it is exporting only records in current view (max. 50). Not much of a use in this case.

Re: Need help with SmartConsole

JanVC — Thu, 10 Dec 2020 13:01:11 GMT

you should do the export from the smartview web console, there you can select to export up to 1 million records

Re: Need help with SmartConsole

HristoGrigorov — Thu, 10 Dec 2020 13:04:30 GMT

@JanVC Thanx, they mean 1MB I think but that's still much better than SmartConsole 😉

Re: Need help with SmartConsole

JanVC — Thu, 10 Dec 2020 13:08:05 GMT

yesterday I exported 192.000 records to csv, file was around 12.5 MB

Re: Need help with SmartConsole

HristoGrigorov — Thu, 10 Dec 2020 13:15:45 GMT

@JanVC Yeah, seems I got it wrong. Did it took long time ? I will test it later today as it sounds promising.

Re: Need help with SmartConsole

JanVC — Thu, 10 Dec 2020 13:24:23 GMT

I didn't stopwatch it, but I guess somewhere between 5-10 minutes

Re: Need help with SmartConsole

JozkoMrkvicka — Thu, 10 Dec 2020 15:37:55 GMT

What about to check first hit of relevant rule ? If you dont have any any accept or very general rules for your boss's computer 😉

Re: Need help with SmartConsole

HristoGrigorov — Thu, 10 Dec 2020 15:48:52 GMT

It is the cleanup rule. I will never allow ldap access from his laptop, not that crazy 😁

I can probably think of other ways to achieve it. But my point was that SmartConsole should natively provide it. On the other hand, grid controls there are so outdated....

Re: Need help with SmartConsole

JozkoMrkvicka — Thu, 10 Dec 2020 16:04:52 GMT

Yes, there are plenty of limitations in SmartConsole related to logs. Some of them are solved in SmartView, but not all.

Assuming you have all logs available and can be recovered (from backup, NAS, tapes), you can create little script. Simply interate over *.fwlog files and use fw log command to export logs. Then do grep and find relevant time.

Or even faster, search for ruleID of cleanup and then grep for specific traffic.

I cannot think about any other solution with current SmartConsole/SmartView.

Re: Need help with SmartConsole

PhoneBoy — Thu, 10 Dec 2020 19:08:51 GMT

If you want export a larger number of records, use SmartView to do it.
It will export up to a million records (versus the "visible" records SmartConsole does).

Re: Need help with SmartConsole

JozkoMrkvicka — Thu, 10 Dec 2020 19:51:31 GMT

Or other way around ... what the boss did on his workstation ? What was the trigger of the flood? Some fancy new application was installed ? Some new updates (Windows) ? Sometimes looking on problem with other side is faster way to figure it out.