topic Re: What happened to loguid/UUid in syslog of new Quantum Spark? in Spark Firewall (SMB)

What happened to loguid/UUid in syslog of new Quantum Spark?

Pedro_Espindola — Thu, 01 Jun 2023 21:05:59 GMT

What happened to loguid/UUid in syslog of new Quantum Spark?

In R77.20.87 for 700/1400 appliances there was the UUid field which could be used to correlate the delta logs.

In the new versions there is no loguid or equivalent field. This means it is impossible to correlate a lot of information, such as the office mode IP of a user that connected to Remote Access VPN.

This was a huge step backwards. The details of the logs have improved, but without this field to allow correlation the logs are useless.

Re: What happened to loguid/UUid in syslog of new Quantum Spark?

PhoneBoy — Thu, 01 Jun 2023 22:12:35 GMT

What code version?
@Amir_Ayalon are you familiar with this issue?

Re: What happened to loguid/UUid in syslog of new Quantum Spark?

Pedro_Espindola — Thu, 01 Jun 2023 22:18:52 GMT

R81.10.XX

I still haven't tested the newest build from last month, but all the previous ones had this ussue.

Re: What happened to loguid/UUid in syslog of new Quantum Spark?

Pedro_Espindola — Tue, 18 Jul 2023 18:13:17 GMT

R81.10.07 is also affected.

Very frustrating, because log rate to SMP is limited to 10000/hour, which is very low, leaving huge gaps in logs.

Also retention is less than a month.

Plus I can't export from SMP to a SIEM.

So exporting syslog was the best way to have a better log retention, which is is a MUST even for small organizations today due to new regulations.

Re: What happened to loguid/UUid in syslog of new Quantum Spark?

Pedro_Espindola — Mon, 25 Sep 2023 22:17:27 GMT

I received a solution from TAC a few days ago.

This solution does not survive upgrades and they still haven't confirmed if it will be made default in the next builds.

Here is the procedure to enable this field:

Access vis SSH to /opt/fw1/conf/log_fields.C

Search for :field_name (uuid)

Change:

:application_display_mode (none)

:application_name (FWLog)

To:

:application_display_mode (own_column)

:application_name (FWLog)

Then run sfwd_restart

Re: What happened to loguid/UUid in syslog of new Quantum Spark?

Tom_Hinoue — Tue, 26 Sep 2023 00:19:45 GMT

Thanks for sharing! good to know 🙂