Follow Rule generates a filtered view of all logs that matched this rule, and is based on the UID number of the rule.In order to filter log entries based on a matching rule, right-click on a log entry and choose either Follow Rule or Follow Rule Number. To display this column, click on View > Query Properties and enable the Rule UID property. This number serves an internal tracking function, and as such the column is hidden by default. The Rule UID column, which records the unique identifying number (UID) that is generated for each rule at the time that it is created.The Rule Name column, which records the short textual description of the rule in the Name column of the Rule Base, when in use.Since then the rule's position in the Rule Base has changed, and so the Current Rule Number column reports its present position as 2, where is the name of the policy package in which this rule resides. When this log was first recorded, it recorded the matching rule as Rule 1. By way of example, note the log entry in the figure.
As the Rule Base is typically subject to change, this column makes it possible to locate the rules that have changed their relative positions in the Rule Base since the log was recorded, and to create filters for log entries that match the rule, not just the rule number.
The Current Rule Number column, which is a dynamic field that reflects the current placement of the rule in the Rule Base and displays the current policy package name. Like other properties in SmartView Tracker, logs can be sorted and queried by rule number. The Rule column, which records the number of the rule in the Rule Base at the time the log entry was recorded. The matching rule is recorded in four columns in SmartView Tracker, as depicted in the figure below: SmartView Tracker records the Firewall Rule Base rule to which a connection was matched. The attributes of the selected query are displayed in the Query Properties pane. An existing query that is copied or saved under a new name is automatically added to the Custom folder. Customized queries are the main querying tool, allowing you to pinpoint the data you are interested in. Custom: allows you to customize your own Query based on a predefined one, to better address your needs. In addition, the Log mode includes predefined per product or feature. The default query of all three modes is All Records. The predefined queries available depend on the mode you are in. Predefined: contains the default queries that cannot be directly modified or saved. A selection of the columns you wish to show - for example, when investigating HTTP requests it is relevant to show the URL log field.Įach of the SmartDashboard modes ( Log, Active and Audit) has its own Query Tree, with these folders:. Condition(s) applied to one or more log fields (record columns) - for example, to investigate all HTTP requests arriving from a specific source, you can run a query specifying HTTP as the Service column's filter and the machine in question as the Source column's filter. This filtering is achieved by running a query.Ī query consists of the following components: You can either display all records in the Log file, or filter the display to focus on a limited set of records matching one or more conditions you are interested in. SmartView Tracker gives you control over the Log file information displayed. SmartView Tracker features these filters as predefined queries. 
It is very useful to filter the Product field and focus on a specific Check Point product. For example, while the Date field is filtered to show data that is after, before or in the range of the specified date, the Source, Destination and Origin fields are filtered to match (or differ from) the specified machines. The filtering options available are a function of the log field in question. Once you have applied the filtering criteria, only entries matching the selected criteria are displayed. SmartView Tracker's filtering mechanism allows you to conveniently focus on log data of interest and hide other data, by defining the appropriate criteria per-log field.
0 kommentar(er)
