topic Re: Application and URL filtering Report from last month in Firewall and Security Management

Application and URL filtering Report from last month

Charlie_Dobson — Tue, 15 Jan 2019 16:10:21 GMT

Hello all,

I am trying to run an application and URL filtering report from last month (which just happens to be "last year"). I specify a custom date range of 12/1/2018 to 12/15/2018 with this query:

product:("Application Control" OR "URL Filtering") AND NOT action:"Redirect" AND type:("Log" OR "Alert" OR "Session") AND NOT app_category:"Network Protocols" AND user:"username (logonname)" AND ("username")

Where "username" and "logonname" are replaced with the appropriate AD attributes, however I do not get any data in the report. If I change the date range to 12/15/2018 to 12/31/2018 I get the same result. However, if I change the date range to 1/1/2019 through 1/8/2019, I get a populated report.

Our Check Point admin left about 5 months ago and I'm still learning all of this, so please bear in mind that I'm still new to all of this.

Is there something I need to do to get the data from last month? Is it automatically archived off into an older database? Is there a process that archives off previous years automatically?

I am using the R80.10 SmartConsole for viewing reports.

Re: Application and URL filtering Report from last month

PhoneBoy — Wed, 16 Jan 2019 00:44:54 GMT

If you look for logs from that timeframe, are they found?

Re: Application and URL filtering Report from last month

Charlie_Dobson — Wed, 16 Jan 2019 12:38:26 GMT

Where do I check?

Re: Application and URL filtering Report from last month

PhoneBoy — Wed, 16 Jan 2019 15:22:55 GMT

In Logs and Monitor (or SmartView).
Go to the Logs tab and click on the clock in the search bar.

Pull down "Custom" and specify the desired timeframe.

The management (or log server) will delete log files if there is limited disk space.

Settings are specified in your management object.

Re: Application and URL filtering Report from last month

Charlie_Dobson — Wed, 16 Jan 2019 17:18:12 GMT

Ah, OK. Yes, I was using the custom timeframe option to specify dates from 12/1/2018 to 12/15/2018 and nothing comes up. Same with 12/16/2018 to 12/31/2018. In fact, I only see stuff as far back as 1/2/2019 and anything before that is blank.

As for the settings on the log server, they are set to alert at 20 MBytes and start deleting at 5000 MBytes, and to delete index files older than 14 days. Disk space on our logging server according to "df -h" is only at 1% used.

It seems that the deleting of the index files older than 14 days is effecting the reports? Does that mean the data is there but since it isn't indexed it isn't showing up?

Re: Application and URL filtering Report from last month

PhoneBoy — Fri, 21 Jun 2019 09:12:46 GMT

Yes, removing index files will affect reporting and the ability to search logs.

Recommend this SK: How to run SmartEvent Offline Jobs for multiple log files

And also this thread: https://community.checkpoint.com/thread/6624-smartlog-only-look-back-14-days-how-to-reindex-90-days-back

Re: Application and URL filtering Report from last month

Charlie_Dobson — Wed, 16 Jan 2019 19:36:26 GMT

Thanks so much! I'm running the re-index now.

Re: Application and URL filtering Report from last month

Charlie_Dobson — Thu, 17 Jan 2019 14:28:19 GMT

I ran the re-index and used $RTDIR/scripts/doctor-log.sh -f to verify that the indexing status is OK, however I still cannot pull data from more than 14 days. Is there any way to verify if the data is actually there in the database?

Re: Application and URL filtering Report from last month

PhoneBoy — Thu, 17 Jan 2019 16:31:53 GMT

Might be a good idea to open a TAC case so we can troubleshoot.

Re: Application and URL filtering Report from last month

Matt_Ricketts — Thu, 17 Jan 2019 17:24:31 GMT

I agree with Dameon. My initial thought was the default 14 days of Index files. However I keep 32 days of Indexes and when I filter my logs on December 2018, I am only seeing logs from 23:59:43 and newer for Dec 31st.