Filtering SonicWall event logs in SonicOS

08/17/2021 86 23262

DESCRIPTION:

This article explains how to filter Logs on the SonicWall as per requirement to see selected log events.

RESOLUTION:

Resolution for SonicOS 6.5

This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

This article briefs about how to filter the event logs based on categories, Source IP, Destination IP, Interfaces, Ports, and Protocols.

Enabling Log Categories

• Navigate to Manage| Logs &Reporting | Log Settings |Base Setup.
• Select/ check categories that you would like to view in logs.
• Click Accept button at the top of the page.
  

Filtering log based on Category

• Navigate to Iinvestigate| Logs | Event Logs

• 
  

  Click on Filter View

  
  

• Select Firewall in Category drop down box.

• 
  

  Click Accept button to see only logs related to Firewall as below.
  

• Once filter is setup, the Event Logs will show logs only for the specified category.
  
  
  

Filtering log based on Source IP

• Navigate to Investigate| Logs | Event Logs.
• Click on Filter View.
• Specify an IP (172.27.76.232) in the Source IP (Type any IP which you would like to see in log).
• Click Accept button to see only logs related to traffic with source IP (172.27.76.232).
  
  
  
• Once filter is configured, all the logs with respect to the specified Source (172.27.76.232) will show up in the event logs.
  

 Filtering log based on Destination IP

• Navigate to Investigate| Logs | Event Logs.
• Click on Filter View
• Specify an IP (8.8.8.8) in the Destination IP (Type any IP which you would like to see in log).
• Click Accept button to see only logs related to traffic with destination IP (8.8.8.8).
  
  
  
• Once the filter view is setup, all the logs with respect to the specified destination (8.8.8.8) will show up in the event logs.
  
  
  

Filtering log based on Interfaces

• Navigate to Investigate| Logs | Event Logs
• Click on Filter View
• Select Source Interface or Destination Interface for which you would like to see traffic in log
• Click Accept button to see only logs related to traffic with selected interface.
  
  
  

Filtering log based on Ports and Protocol

• Navigate to Investigate| Logs | Event Logs
• Click on Filter View
• Specify the Source Port or Destination Port or Protocol for which you would like to see traffic in log
• Click Accept button to see only logs related to traffic with selected ports or protocols.
  

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Log in to SonicWall Management Page and follow below steps

• Navigate to Log | Categories.
• Select/ check categories which you would like to view in log under Log Check box.
• Click Accept Button at the top of the page.
  
  Filtering log based on Category
  
  Log in to SonicWall Management Page and follow below steps
• Navigate to Log | View.
• Select Network Access in Category drop down box.
• Click Apply Filter Button to see only logs related to Network Access as below.
  
  Filtering log based on Source IP
  
  Log in to SonicWall Management Page and follow below steps
• Navigate to Log | View.
• Type 192.168.60.81 (Type any IP which you would like to see in log) in Source (IP, Interface).
• Click Apply Filter Button to see only logs related to traffic with source IP (192.168.60.81).
  
  
  Filtering log based on Destination IP
  
  Log in to SonicWall Management Page and follow below steps
• Navigate to Log | View.
• Type 192.168.60.98 (Type any IP which you would like to see in log) in Destination (IP, Interface).
• Click Apply Filter Button to see only logs related to traffic with source IP (192.168.60.98).
  
  
  Filtering log based on Interfaces
  
  Log in to SonicWall Management Page and follow below steps
• Navigate to Log | View.
• Select X0 (select any interface for which you would like to see traffic in log) in Source (IP, Interface) & Destination (IP, Interface).
• Click Apply Filter Button to see only logs related to traffic with selected interface.