Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
resu
Participant
Jump to solution

Log query R80.10

I would like to run a query (something like NOT action:drop) on a list of unique IP addresses. I've looked through documentation and tried IP's with a space between, with "AND" (no quote marks) between. Neither worked. 
Any advice is appreciated.

1 Solution

Accepted Solutions
Dror_Aharony
Employee Alumnus
Employee Alumnus

Log = single line of traffic.

Unique IP of either src/dst (usually).

 

try OR instead of AND (implicit AND) & let me know if this works out for you.

src:(X OR Y OR Z) NOT action:Drop.

or

src:X OR src:Y OR src:Z NOT action:Drop.

 

 

View solution in original post

7 Replies
Gomboragchaa
Advisor

When you use queries with more than one criteria value, an AND is implied automatically, so there is no need to add it. Enter OR or other boolean operators if needed.

http://downloads.checkpoint.com/dc/download.htm?ID=65843

 

Dror_Aharony
Employee Alumnus
Employee Alumnus

Hi resu,

Can you please share the exact queries that fail to find your desired results and exact R80.10 JHF-version?

 

resu
Participant

Version: R80.10
Build: SmartConsole 991140013

I would like to query a list of unique IP addresses. So two (possible) queries might look like this (separated by a space, since the AND is implicit):

Query 1:

IP1 IP2 IP3

Query 2:

IP2 IP2 IP3 NOT action:drop


Dror_Aharony
Employee Alumnus
Employee Alumnus

if both these queries fail (even without the NOT), only free-text IPs, then it's already fixed in the latest JHF.

for R80.10 only, you need to write either a src or dst. as a complete IP free-text wasn't supported.

 

Also, I think what you're looking for is an OR, not an AND here. (as you'll probably never have 3 unique IPs in the same log).

example: (src:X OR dst:X) OR (src:Y OR dst:Y)

then you can add: AND action:Drop.

 

Best to install the latest JHF anyway.

 

resu
Participant

Apologies. I may have misunderstood how you define "log". 

Does "log" mean a single line item of traffic? I was thinking of that as an "entry" or "record" but am happy to be corrected.

If "log" means a collection of rows of traffic events, then I would say that I see multiple IP's in a log all the time.

I'm using R80.30

Dror_Aharony
Employee Alumnus
Employee Alumnus

Log = single line of traffic.

Unique IP of either src/dst (usually).

 

try OR instead of AND (implicit AND) & let me know if this works out for you.

src:(X OR Y OR Z) NOT action:Drop.

or

src:X OR src:Y OR src:Z NOT action:Drop.

 

 

resu
Participant
Apologies, didn't see other post. Thanks very much, this is it.
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events