Recently working with a customer to get upto speed with R80.10, and replacing a proxy solution with Checkpoints App&URL blade solution, an interesting issue came up when it came to hand over the project to BAU.
When a block page is generated, Checkpoint has a few auto-generated fields that help with the tshooting. such as source IP, the Application.
but what use is this, really, in a fast paced environment when there could be thousands of hits. You need to find a specific log entry.
Checkpoint have a source field for this, called 'Incident ID', which is inserted into the UserCheck page.
When a block page is presented, the log that Checkpoint generates looks like this: (i used www.thesun.co.uk for example purposes)
this block page has just been emailed to your Support Guys. How do they find this Block Log?
ok, well lets jump onto SmartLog and search for this reference number...
Well that isnt ideal. OK, lets search for that reference in the incident_id field instead:
As you can see, this is not a quick find for your support guys.
instead, lets try looking for the specific log with a full filter, and ignoring the Incident_ID reference number. (this is a pure test machine, so traffic flow is minimal)
If i now open the log with the 12:03 timestamp and try to find my log reference number, of 81817825 i find it is a suffix of the field 'UserCheck ID'
however this field is not selectable within SmartLog. Interesting....
What i have then enabled, is i have modified my Block Page to contain a wildcard prior to the log ref number. This allows for the userCheck ID field to be correctly searched, and also allows for Support to perform quick searches and saves alot of time, as now a simply copy-and paste will pull up the log.
example of the Source Code in userCheck:
Which gives this output in Support Ticket generation:
Now Support can enter this into SmartLog to get the specific log
I hope that helps. i couldnt find an SK on this but it must exist.
also, i tried this in SmartTracker on a R77.30 device, the field was then called 'UID', but wildcards dont word when filtering, nor does the 'contain' option. How did this used to work? if anyone has another way to parse this log IDs i'd love to hear it.