Need help with SmartConsole

[HristoGrigorov]

Hello,

I have two questions regarding smart console (R80.40):

1. How do I reverse log query by time? I mean if I want to see what was the first time matching entry was logged in, for example within the Last 7 Days how do I do it, without some long and painful scrolling of course ?

2. Why am I not able to copy time cell to clipboard ? It seems to work for all other cells but not this one.

Thanx in advance.

[PhoneBoy]

Using SmartView (instead of SmartConsole) might fix the second issue, but for the first, you might have to open up SmartView Tracker to do that one more efficiently.
Question is: why is that relevant?

[HristoGrigorov]

Hmm, if you ask me about what is the use case here, how about this:

1. My boss asked me what time exactly his laptop started to flood our active directory with ldap requests? I could not give answer in a sensible time and had to scroll for a long time day by day to find out. Not very pleasant if you ask me.

2. Being able to copy all but one cell gives me the impression software is "incomplete" unless there is a technical explanation why it is not possible.

[PhoneBoy]

Well...that is an interesting use case. 🙂
At some point, SmartView was supposed to replace what was in SmartConsole and you should be able to copy/paste that cell from there.

[HristoGrigorov]

Can't do it in SmartView either, just tried. Only way is to double click on the record and copy from pop-up window. Not very convenient but does the job.

[ED]

Hi Hristo,

You can try this. It's not a perfect solution but at least it will save you some scrolling 🙂

Mark a log and then press either "Page Down" on your keyboard to get to the bottom and "Page Up" the other way. Keep holding one of the keys till you get to the bottom (might take a while 🙂 )

The perfect solution would be to have the "Home" and "End" function as the top and bottom button. Or being able to click on the "Time" column and sort by time, just like in Excel. 

[HristoGrigorov]

@ED Thanx, my thoughts exactly. Although, I would be happy with export in Excel also but sadly that's not available ☹️

[ED]

Have you tried this?

[Borut]

You can export the logs to CSV by clicking the 3 line icon next to search box and chose File -> Export to Excel CSV...

I believe, all the relevant logs in the selected timeframe are exported.

[HristoGrigorov]

@Borut Thanx, that would be perfect but it is exporting only records in current view (max. 50). Not much of a use in this case.

[JanVC]

you should do the export from the smartview web console, there you can select to export up to 1 million records

[PhoneBoy]

If you want export a larger number of records, use SmartView to do it.
It will export up to a million records (versus the "visible" records SmartConsole does).

[HristoGrigorov]

@JanVC Thanx, they mean 1MB I think but that's still much better than SmartConsole 😉

[JanVC]

yesterday I exported 192.000 records to csv, file was around 12.5 MB 

[HristoGrigorov]

@JanVC  Yeah, seems I got it wrong. Did it took long time ? I will test it later today as it sounds promising.

[JanVC]

I didn't stopwatch it, but I guess somewhere between 5-10 minutes

[JozkoMrkvicka]

What about to check first hit of relevant rule ? If you dont have any any accept or very general rules for your boss's computer 😉

[HristoGrigorov]

It is the cleanup rule. I will never allow ldap access from his laptop, not that crazy 😁

I can probably think of other ways to achieve it. But my point was that SmartConsole should natively provide it. On the other hand, grid controls there are so outdated.... 

[JozkoMrkvicka]

Yes, there are plenty of limitations in SmartConsole related to logs. Some of them are solved in SmartView, but not all.

Assuming you have all logs available and can be recovered (from backup, NAS, tapes), you can create little script. Simply interate over *.fwlog files and use fw log command to export logs. Then do grep and find relevant time.

Or even faster, search for ruleID of cleanup and then grep for specific traffic.

I cannot think about any other solution with current SmartConsole/SmartView.

[JozkoMrkvicka]

Or other way around ... what the boss did on his workstation ? What was the trigger of the flood? Some fancy new application was installed ? Some new updates (Windows) ? Sometimes looking on problem with other side is faster way to figure it out.

[HristoGrigorov]

@JozkoMrkvicka Agree but this happened some time ago and he asked me around what date flooding started so he could actually think of what he changed/installed. It is not so bad, flood is not aggressive hence why I did not noticed it for some time. 

[JozkoMrkvicka]

Well... If you dont know what you did how you are supposed to know what happened at specific date and time ? Windows has some logs (events) which can be searched. Or using wireshark you should be able to check what application is causing the flood. But that would mean you need to have access to the workstation, which might be issue if we are talking about your supervisor 😉

I fully understand that Check Point should be able to provide all data you are looking for. I am also not sure if such basic feature is available in R81... Asking for RFE might help in the future. Or maybe this is basic functionality to be part of new R80.x/R81Jumbo...

[JozkoMrkvicka]

If you have installed Take 78 or higher on your R80.40 management, then you can try to use show-logs API. I did not try it, but maybe it can be used to speed-up searching or give you some interesting outputs.