Raw Search

Select this option if you want to search from the logs indexes and archive.

If you have selected the Raw Firewall Logs option in the Search Type and index Security Logs only option in the Raw Search settings, the following options will be enabled: Raw VPN Logs, Raw Virus/Attack Logs, Raw Device Management Logs, and Raw Denied Logs

If you have selected the Raw Firewall Logs option in the Search Type and the index Traffic & Security logs option in the Raw Search settings, the following options will be enabled: Raw VPN Logs, Raw Virus/Attack Logs, Raw Device Management Logs, and Raw Denied Logs and additionally Traffic logs option.

Choose the required logs to be searched.

In the Search Type, you can also select  Raw Proxy Logs and Unknown protocol from the dropdown list.

Selected Devices

In this section, you can choose the devices for which you want the logs to be searched. There are 2 lists,

1. Available devices list
2. Selected devices list

By default all the devices are selected and available in the Selected Devices list. If you want to change the list of selected devices, select the required devices in the Available devices list and move it to the Selected devices list and vice versa. The selected devices are displayed in this section.

Define Criteria

If you have selected the Raw Firewall Logs option in the Search Type, this section enables you to search the logs for attributes using more than one of the following criteria: 

If you have selected the Raw Proxy Logs option in the Search Type, this section enables you to search the logs for attributes using more than one of the following criteria: 

If you have selected the Unknown Protocol option in the Search Type, this section enables you to search the logs for attributes using more than one of the following criteria: 

Click Generate button. On clicking Generate button you will see the search results.

If the search string exists then the search result will be displayed in two tabs, Formatted Logs and Raw Logs.  In the Formatted Logs tab, the search result is fetched from the log indexes and displayed.

In the Formatted Logs tab, the search results are displayed in a table format with the following column:

• Device
• Host
• Source Port
• User
• Protocol
• Destination
• Destination Port
• Date/Time
• Virus/Attack
• VPN
• Severity
• Rule Number/ID
• Status
• URL
• Category
• Duration
• Description
• VPN Group
• Port based
• Sent
• Received

In the Raw Logs tab, the search result is fetched from the log archives and displayed as raw logs.

Choose Columns, Save buttons on right top of the screen.

Choose Column will list all the columns of the result table. You can select the columns for display as per your choice.

Raw Settings

To enable indexing of raw logs follow the steps given below:

In Search screen, select the Raw Setting link. Raw Data Indexing page appears.

• Raw Data Indexing: Move Enable or Disable slider button to enable or disable indexing of raw logs.
• If you want to index security logs only, select Index Security Logs only radio button. If you select the Raw Firewall Logs option in the Search Type and index Security Logs only option here, the following options will be enabled: Raw VPN Logs, Raw Virus/Attack Logs, Raw Device Management Logs, and Raw Denied Logs
• If you want to index both traffic and security logs, select Index Traffic & Security Logs radio button. If you select the Raw Firewall Logs option in the Search Type and the index Traffic & Security logs option here, the following options will be enabled: Raw VPN Logs, Raw Virus/Attack Logs, Raw Device Management Logs, and Raw Denied Logs and additionally Traffic logs option.
• Click Save to save raw log index settings.

 You will require additional hardware for index log storage space, refer hardware requirements in the System Requirements page.