topic Re: Log File (fw.log) in Firewall and Security Management

Log File (fw.log)

Dominic — Thu, 23 Apr 2020 14:35:46 GMT

Hi team,

I want to import the log file (fw.log) back to my database because I am forced to generate a report for the previous month.

Note; the existing active log file) (fw.log) only has the recent events alone.

Kindly advice.

Re: Log File (fw.log)

Dror_Aharony — Thu, 23 Apr 2020 15:20:30 GMT

Not sure I follow.

Which version are you using?

Do you want to re-Index the fw.log into the SmartEvent? or do you mean all log-files from the past month?

Do you need the correlated events as well? which report?

Please describe the scenario again.

Re: Log File (fw.log)

Dominic — Thu, 23 Apr 2020 18:07:13 GMT

Please note that I'm not trying to achieve anything to do with smart event and re-indexing at the moment.
Is it possible to import the log file (fw.log) through WinSCP or via smart view tracker back to log server. In either way without any effect on the active log file, what will be the right approach and guideline?

Re: Log File (fw.log)

Pedro_Espindola — Thu, 23 Apr 2020 19:19:08 GMT

You can rename it and copy it back to $FWDIR/log/ in your log server.

Then you can open it with SmartView Tracker (R77) or using the open file option in SmartConsole (R80+).

If you have problems you can try to repair it following the procedure from sk98929 with te command:

fw repairlog -u  <Name_of_Log_File>.log

Now, if you need to create a report with data from this file, then additional indexing steps will be needed.

Re: Log File (fw.log)

Dominic — Thu, 23 Apr 2020 20:56:54 GMT

What will happen with the existing active log file (fw.log)...?

Then note that, I am currently on Gaia R80.10 HA, so should I use smart view tracker or import via WinSCP ...?

Re: Log File (fw.log)

Pedro_Espindola — Thu, 23 Apr 2020 22:17:03 GMT

First you have to copy the file to $FWDIR/log/ with WinSCP and then you can open it with SmartConsole or SmartView Tracker.

Rename it first so you won't overwrite the current fw.log.

Re: Log File (fw.log)

Dominic — Thu, 23 Apr 2020 22:23:48 GMT

Hi Pedro,
I did rename it then imported to$FWDIR/log through WinSCP . Funny enough I couldn't view the logs even though it was existing on the console. What I would wish to understand ; should the import happen through the smart view tracker or through WinSCP?

Re: Log File (fw.log)

PhoneBoy — Sun, 26 Apr 2020 01:59:05 GMT

You have to use WinSCP to copy the file to the platform before you can use any other tool to read the log file.

Re: Log File (fw.log)

Dror_Aharony — Sun, 26 Apr 2020 06:15:56 GMT

Pedro is absolutely correct, but it's safer to close/switch the fw.log (active log-file) 1st, unless that somehow troubles you?

that is done automatically when it reaches the max size of 2GB or daily (>=R80) or GUI configured.

so run this:

fw logswitch <chosen_name>

# if you don't name, then it names it by default as the current date/time (2020-04-26_091200.log).

Copy (all <name>.log*), via scp/winscp or any other way. Put in $FWDIR/log/ & open it via Tracker/Open Log-File.

If you've already renamed it, then best run the fw repairlog <new-name.log> & verify it succeeds, then copy all <name>.log* files.

Re: Log File (fw.log)

Pedro_Espindola — Mon, 27 Apr 2020 15:29:32 GMT

You can only open the file with SmartLog or SmartView Tracker after the file is in $FWDIR/log/. When you select the open log file option it will give you a list of log files in $FWDIR/log/. Just select the correct one.