AnsweredAssumed Answered

R80.10 Smartview Reports not showing allowed traffic

Question asked by Anton Jordan on Jul 25, 2018
Latest reply on Jul 27, 2018 by Anton Jordan

Hi All,

R80.10 Openserver - Mngmt running Log Server/Smartevent also
Having an issue with running reports atm..

 

Using Filter - 'service=ssh'

 

Withing Smartview logs I can see logs all fine.. accept/drop etc etc
But when running a report however it doesn’t show 'ssh' packets accepted/allowed.. but shows only ssh dropped packets.
It appears I cannot get a report on packets that are allowed/accepted etc..
In my normal logs I can see them.. but in the report.. it shows nothing for accept/allow. I have only one filter (service = ssh) defined and nothing being inherited also that I can see that will exclude accept/allowed from being omitted.

 

Running the pre-defined report - Network Activity - Access control.

 

In my SmartEvent policy config I have ‘Firewall Session’ checked under 'Event Policy -> Consolidation Sessions'

 

Any ideas?
thanks in adv

Outcomes