search in log for "PenaltyBox" not possible

[Wolfgang]

Hello CheckMates,

it's not possible to search in logs for entries blocked by PenaltyBox-feature  (fwaccel dos pbox...)

Search for "Penalty" or "DOS" brings no results. Looks like these fields are not indexed ?

Why not? Every shown field should be searchable.

Any way to find these logs without to know the source IP ?

[PhoneBoy]

Not every log field is indexed is for performance reasons.
That does make certain logs…harder to find.

[HeikoAnkenbrand]

Hi @Wolfgang,

Not all fields in SmartLog are displayed in the console. In sk144192  there are more log fields described that you can use.

Maybe the following fields can help:
- securexl_message

[Wolfgang]

@HeikoAnkenbrand  and @PhoneBoy 

No chance at all. None of the shown fields "SecureXL Message", "comment" or "Feature Name" is available to a filter.

Same in old Logviewer.

I'm not happy that you had no chance to find an information if the PenaltyBox is detecting something 😞

[Wolfgang · Accepted solution]

small update….

With R81 the comment field is searchable. Now you can search „penalty box“ and there are results shown 😀

[PhoneBoy]

I suspect there were some "under the hood" changes in R81 given you have to reindex all the logs when you upgrade.
Also, an interesting tidbit in the R81.10 EA release notes: The Solr functionality is replaced with a PostgreSQL database to improve the stability and performance of the Security Management Server.
Which means: more under the hood changes are coming 🙂

[olliM]

Hi Wolfgang,

we had the same issue with R80.x. Because there was no solution for that, i tested some filter combinations and found a workaround.

Using the following filter to display the needed infos in logs:

(type:"Alert") and not (src:"ips of your internal network" or dst:"your ips from external networks")

It may be necessery to select or edit the correct profile for displaying the field "Firewall Message" in the logging table.

[CheckPointerXL]

you can try with "penalty box"