topic Re: SmartLog -- Difference between "product" and "blade" in Firewall and Security Management

SmartLog -- Difference between "product" and "blade"

Paul_Warnagiris — Mon, 21 Sep 2020 21:32:14 GMT

Hello Checkmates. I had a customer ask me an interesting question that I didn't know the answer to.

Performing this query type:("Log" OR "Alert" OR "Session") AND product:"Anti-Spam and Email Security" NOT action:Accept NOT action:Bypass versus this query blade:"Anti-Spam and Email Security" NOT action:Accept NOT action:Bypass gives very similar but not the same results. Obviously the difference in the search is "blade" and "product" and there are more results with Product, but why and what is the difference? One would think the second query would show more since its not specific on the type, but actually the product search with the defined types shows more. See below.

Any idea?

Thanks,
Paul

Re: SmartLog -- Difference between "product" and "blade"

G_W_Albrecht — Tue, 22 Sep 2020 09:10:55 GMT

I would export the different lists and compare - should be obvious then. Screenshots posted do help nothing to analyze this, though...

Re: SmartLog -- Difference between "product" and "blade"

Paul_Warnagiris — Wed, 23 Sep 2020 17:02:19 GMT

Interestingly enough that's the point. Both lists are above. The provide the same results with one exception. In one list with the entry highlighted in yellow the SPAM message does not appear and in one list it does. In the one where it does it is expanded and pasted below:

Why does it show up in the more specific query where I specifically state the type and it doesn't if I don't state the type by just requesting to see logs from PRODUCT. Does that make sense? This is not the end of the world, but it is certainly odd.

Re: SmartLog -- Difference between "product" and "blade"

PhoneBoy — Wed, 23 Sep 2020 17:56:43 GMT

The concept of “blades” didn’t come in until R70.
Prior to that logs were logged by “product.”
My guess is there a few places in functionality that existed Pre-R70 where “blades” weren’t added to the logs where it should be.