SmartLog: Search Narrowing only works under certain circumstances

[karsten_wiborg]

Hi,

I do not understand the way CheckPoint is implementing Search Narrowing in SmartLog in R80.10 and possibly above. I have 2 situations:

1.) go to a column, right mousekey, "add Filter": you'll get a suggestion of about 10 items and at the top of the Add-Filter-window a search line with a magnifying glass to the left. Try to search for a network object within your network object database! There is an sk for that: sk122813

At least in my installations you won't find your objects (except the 10 items initially presented). According to RnD and sk122813 that is by design. But that doesn't make sense to me. If there is a search line I do expect to narrow down the search by typing the letters and getting therefore closer to the object I'm searching for. And that only works for the initially provided 10 items.

According to RnD this behaviour is because of performance considerations but if I get only the initially presented 10 items what is the use-case for the searchline? And increasing the limit of 10 results is not really an option for obvious reasons.

2.) Querying the log with the top search line (above the columns). According to RnD search-narrowing is only working with SuperAdmin-equivalent rights. But consider a helpdesk with a restricted profile. A helpdesk is usually your first point of response and might need to query the log but is not supposed to have SuperAdmin-rights.

Now try to do search narrowing with limited rights. It does not work (in my installations). Enter src: and start typing the first letters for one of your objects. At least in my installation I am not getting suggestions for matching objects.

According to RnD it only works for Admins with SuperAdmin-Rights.

This is sort of difficult to explain to customers. Does anyone know a fix for that other than give helpdesk SuperAdmin rights?

Regards,

Karsten

[Maarten_Sjouw]

Karsten,
Could you test the same things when you go to the logs through a browser with the following URL: https://<IP-of-Mgmt>/smartview
Where <IP-of-Mgmt> is the IP of the SMS or DMS.

[karsten_wiborg]

Hi Maarten,

thank you for replying.

I just opened the log through the browser on an another system but wasn't able to  do any search narrowing in the main query-line at all. I also wasn't able to open the search-window by clicking on the column-title.

Regards, Karsten