Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Iron

Log query R80.10

Jump to solution

I would like to run a query (something like NOT action:drop) on a list of unique IP addresses. I've looked through documentation and tried IP's with a space between, with "AND" (no quote marks) between. Neither worked. 
Any advice is appreciated.

1 Solution

Accepted Solutions
Highlighted
Employee+
Employee+

Re: Log query R80.10

Jump to solution

Log = single line of traffic.

Unique IP of either src/dst (usually).

 

try OR instead of AND (implicit AND) & let me know if this works out for you.

src:(X OR Y OR Z) NOT action:Drop.

or

src:X OR src:Y OR src:Z NOT action:Drop.

 

 

View solution in original post

7 Replies
Highlighted

Re: Log query R80.10

Jump to solution

When you use queries with more than one criteria value, an AND is implied automatically, so there is no need to add it. Enter OR or other boolean operators if needed.

http://downloads.checkpoint.com/dc/download.htm?ID=65843

 

Highlighted
Employee+
Employee+

Re: Log query R80.10

Jump to solution

Hi resu,

Can you please share the exact queries that fail to find your desired results and exact R80.10 JHF-version?

 

Highlighted
Iron

Re: Log query R80.10

Jump to solution

Version: R80.10
Build: SmartConsole 991140013

I would like to query a list of unique IP addresses. So two (possible) queries might look like this (separated by a space, since the AND is implicit):

Query 1:

IP1 IP2 IP3

Query 2:

IP2 IP2 IP3 NOT action:drop


Highlighted
Employee+
Employee+

Re: Log query R80.10

Jump to solution

if both these queries fail (even without the NOT), only free-text IPs, then it's already fixed in the latest JHF.

for R80.10 only, you need to write either a src or dst. as a complete IP free-text wasn't supported.

 

Also, I think what you're looking for is an OR, not an AND here. (as you'll probably never have 3 unique IPs in the same log).

example: (src:X OR dst:X) OR (src:Y OR dst:Y)

then you can add: AND action:Drop.

 

Best to install the latest JHF anyway.

 

Highlighted
Iron

Re: Log query R80.10

Jump to solution

Apologies. I may have misunderstood how you define "log". 

Does "log" mean a single line item of traffic? I was thinking of that as an "entry" or "record" but am happy to be corrected.

If "log" means a collection of rows of traffic events, then I would say that I see multiple IP's in a log all the time.

I'm using R80.30

Highlighted
Employee+
Employee+

Re: Log query R80.10

Jump to solution

Log = single line of traffic.

Unique IP of either src/dst (usually).

 

try OR instead of AND (implicit AND) & let me know if this works out for you.

src:(X OR Y OR Z) NOT action:Drop.

or

src:X OR src:Y OR src:Z NOT action:Drop.

 

 

View solution in original post

Highlighted
Iron

Re: Log query R80.10

Jump to solution
Apologies, didn't see other post. Thanks very much, this is it.
0 Kudos