The Logs and Reports Menu¶

In this page you find:

In the logs and reports section of the UTM there are different possibilities to look at and to analyse the log files.

The sub-menu on the left-hand side of the screen contains the following items:

Dashboard - the reporting module, a graphical depiction of log files and events.
Live Logs - get quick, live view of the latest log entries as they are being generated.
Summary - get daily summaries of all logs.
System - system logs (/var/log/messages) filtered by source and date.
Service - logs from the intrusion detection system (IDS), OpenVPN, and antivirus.
Firewall - logs from iptables rules.
Proxy - logs from the HTTP, SMTP, and content filter proxies.
Settings - customise all the log options.
Trusted Timestamping - securely time stamp the log files to verify they have not been altered.

In a nutshell, there are three modalities to access the log from the GUI: Graphically, live and by-service. The first is represented by the reporting module, while in the live mode the log files are visualised as soon as they are created, and in the by-service mode only the logs produced by one daemon or service at a time are displayed.

Dashboard ¶

The reporting GUI module has the purpose to graphically show the occurrence of various types of event on the system.

In a nutshell, the reporting module shows events happened on the UTM using different widgets and graphs. All events occurring on the system and the information concerning them recorded by the syslog daemon are parsed and used to populate a sqlite3 database. According to the options and to the filters applied in the GUI, this database is queried to gather the available data and display them to the user.

This page is divided into multiple tabs: Summary, System, Web, Mail, Intrusion attempts, Viruses, and Connections. Except for the first tab, which shows an overview of all events, each of them is dedicated to one service running on the UTM.

Common elements ¶

All the tabs in this module share the same design: Below the tabs, on the left-hand side there are a date selector and a Print button on the right-hand side. Then, a line chart at with an horizontal slider right below, atop one informative box (Summary Grid) containing on the left-hand side one or more tables, depending on the tab and the data shown and a pie-chart on the right-hand side.

At least the table displaying the syslog messages related to the events shown is always present.

More in detail, here is a description of all the widget present in the reporting module.

Date selector: At the top left-hand side of the GUI there is an hyperlink that shows the interval within which occurred those events that have been considered for the charts. By clicking on it, a small panel gives access to other choices of intervals. There are two types of choices, the first one concerns events that took place in the last … days, namely events from the last day, week month, quarter, or year; the second one selects all the events occurred in one of the last 12 months. Upon selecting a new time span, the other widgets are also updated. There is also the possibility to not change the interval shown, by clicking on Cancel.
Print: A click on this button shows a print preview of the current page.

Line Chart and Time Slider

The line chart shows the event happened on the UTM during the selected time span in a two dimensional graph, in which the x-axis shows the time interval and the y-axis shows the number of occurrences. A coloured line connects events of the same type.

Hint

Different types of event are denoted with different colours.

The time slider is located underneath the chart and allows, within the selected time span, a more fine-grained view of the events, depicted here as histograms. Indeed, the two grey handles on the left and right limits of the slider can be clicked and dragged to reduce the time span shown in the line chart. When reduced, the slider can also be moved by clicking in its middle and dragging it to the left or the right.

Summary Grid

The summary grid has a twofold purpose: On the one side to show the number of occurrences of the various types of events that took place on the UTM in the selected period, on the other side to filter the type of events shown in the line chart. Its content depends on the tabs it is located in and is not present in the Mail, Intrusion attempts, and Viruses tabs, in which is replaced by tables which group different details about the events.

Pie Chart

The pie chart diagram shows graphically the number of event that took place in the selected time span. When in the Summary tab, each slice can be clicked, to open the tab corresponding to the type of event and show a more detailed representation.

Syslog table

A table that shows the syslog messages extracted from the log files and related to the events shown in the charts. When the table carries lot of messages, these are divided into many pages and can be browsed using the buttons and number at its left bottom. At the right bottom there is an icon that allows to refresh the table’s content.

Summary ¶

The Summary tab gives an overview of all categories of events recorded on the UTM. The summary grid allows to filter the following types of events:

System. The number of Log ins and other events connected with system administration tasks (e.g., uplinks change of status, start and stop of logging, and so on) .
Web. The number of pages blocked by the content filter.
Mail. The number of spam e-mail received.
Intrusion attempts. The events recorded by the IPS.
Viruses. The number of viruses found.

Each category can be shown separately, with more information and a higher level of details in the other tabs of the page, see further on.

System ¶

The System tab displays all events that are related to the system efficiency and to system administration. These are all the events shown:

Login. The number of logins, both successful and not.
Status. The changes in the state of the UTM.
Disk. The events involving disk I/O.
Support. Number of accesses and operations donw by the Support Team.
Upgrade. Events involving upgrade of system or of packages.
Uplink. The times the uplink(s) went online or offline.

A click on the small icon on the left-hand side of each event category shows details about the events that are part of that category and updates the pie chart.

Web ¶

The Web tab displays the number of pages that have been accessed or blocked by the URL filter engine. The summary grid is composed by two tabs: Access report and Filter report.

Access report ¶

This tab shows the domains that have been accessed, grouped into three tables showing respectively the Source IP Address recorded by the HTTP Proxy, the Domain accessed, and the Users who requested the web page, with the total count for every item.

Note

The Access report tab is not present in all appliances.

Filter report ¶

This tab shows to which domains the access has been blocked. In the first table, the following categories are shown.

General Use.
Parental Control.
Productivity.
Security.

When the checkboxes on the left-hand side of the Blocked category are not ticked, items in that category are not displayed. A click on the icon on the left of the checkbox will expand the category and show all its sub-categories, that can be selected or not, to draw more detailed diagrams.

The other tables at the bottom show the counts of each the blocked objects: The Source IP Addresses and the Domain.

Mail ¶

The Mail tab displays all e-mails blocked as spam.

There is no summary grid in this tab, but three tables displaying counts for:

From. The sender(s) of spam e-mails.
To. The recipient(s) of spam e-mails.
Source IP Address. The IP address from where spam e-mail have been sent.

Intrusion attempts ¶

The Intrusion attempts tab displays all tentative intrusions detected by the IPS (See Menubar ‣ Services ‣ Intrusion Prevention).

The tables at the bottom show counts of the following information:

Intrusion attempts. The categories under which falls each attempt.
Source IP Address. The IP address from where the attack originated.
Destination IP Address. The IP Address to which the attach was launched.

Viruses ¶

The Viruses tab displays all viruses intercepted by the anti-virus engine (See Menubar ‣ Services ‣ Antivirus Engine).

The tables at the bottom show counts of the following information:

Virus Name. The name of the virus found.
Source IP Address. The IP address where the virus originally was located.
Destination IP Address. The IP Address to which the virus was propagated.

Connections ¶

The Connections tab displays the average number of connections started by the users of the UTM, grouped into:

Local connections. Accesses via SSH or console.
IPsec users. Clients connected via IPsec.
Hotspot users. Users accessing the Hotspot.
OpenVPN users. Clients connected using OpenVPN.

Live Logs ¶

In this module it is possible to show the log files of the UTM in real time as they are produced.

Live Log viewer

When entering in the Live Logs section, the list of the log files available for real time viewing is shown. Any number of logs to watch can be chosen by ticking the corresponding checkbox; they will be displayed in a new window upon clicking on the Show selected logs button on the bottom of the table.

To watch all the log file at once, tick the Select all checkbox on the left-hand side of the Service label and click on the Show selected logs button.

A single log file can be viewed by simply clicking on the icon in the Actions column on the right-hand side of the corresponding log file.

The window that opens contains two boxes, Settings at the top and Live logs at the bottom.

Warning

The list of log entries can become nearly unreadable if many logs are showed at once, due to the possible high number of log entries produced, for example by the firewall or VPN log, which can generate multiple log entries per second, especially in case of heavy traffic.

Settings ¶

This box allows to modify the settings of the log viewer, including which of the log files to show, their colour and options to highlight or find specific keywords.

On the right-hand side of the box appears the list of the logs that are currently displayed, and the colour with which they are highlighted, while on the left-hand side some additional control elements are shown, that help limit the output:

Filter: Only the log entries that contain the expression in this field are shown.
Additional filter: Like the filter above, but applied to the output of the first filter. In other words, only log entries containing both expressions are shown in the log.
Pause output: Clicking on the Pause now button will prevent new log entries from appearing on the live log. However, after clicking the button once more, all new entries will appear at once, quickly scrolling the old ones.
Highlight: All the log entries that contain this expression will be highlighted in the chosen colour. The difference with the filtering option is that all the content is still displayed and the log entries containing the expression will be highlighted with a coloured background.
Highlight color: A click on the coloured square gives the choice to select the colour that will be used for highlighting.
Autoscroll: This option is only available if the Sort in reverse chronological order option in the Menubar ‣ Logs ‣ Settings section is turned off. This causes all the new entries to be shown at the bottom of the page: If this option is enabled, the list is scrolled upwards to show the latest entries at the bottom of the page, otherwise only the older entries are show and the scrollbar on the right should be used to see the new ones.

To change the log to be watched, click on the Show more link right below the list of the log files on the top right corner. The box will be replaced by the list of log files; here, tick the checkbox of the log to be shown and untick the checkbox of those that should not appear.

To change the colour of a log file, click on the colour palette -between the checkbox and the service name- of that log type and then choose a new colour. To close the list of logs and show the settings again, click on Close either below the services or below the list of the displayed log files.

Live logs ¶

The logs chosen for viewing are shown in this box, which consists of a table divided in three columns.

Left column: This column contains the log name, that is, the daemon or service producing the log entry.
Middle column: The time stamp (date and time) of the event that has been recorded.
Right Column: The actual message generated by the service or daemon and recorded in the log files.

Note

Some log messages -especially Firewall entries- span more than one line. To show the whole message, click on it or on the button at the right of the message.

Finally, there is also the chance to increase or decrease the window size by clicking on the Increase height or Decrease height buttons, respectively, which are situated on the top right heading of the box.

Type to Filter…: Type a pattern that will be used to retrieve only the log messages containing it.
Date Selector: Show log entries only on the selected date. Click on the current date to open a dialog window that allows to choose other dates. Only dates in which log files have been produced are selectable; the other are greyed out. To search for previous months or years, click on the month or year.

Note

Log files are rotated daily during the night. If at that time the UTM is powered off, no rotation takes place and all the entries in the log file will be considered as today’s entries, even if they were generated on the previous day(s).
Older, Newer: These two buttons allow to browse older or newer entries of the search results by clicking on them.
Export: A click on this button will download the log file.

Note

The name of the downloaded file includes the UTM's hostname, the path to the log file, and the day on which it was exported; its suffix will be .log. Example: efw-endian_var_log_messages_20190627.

At the bottom of the page, two additional controls are available, one on the left-hand side, the other on the right-hand side.

Total, Items/page: The total number of lines in the log file is shown, together with the current pagination value, that can be changed to display less or more messages per pages.
Jump to Page: If log file becomes quite long, or the pagination value is low, or both, the log file will be displayed in multiple pages. Click on the number of the page or on one on the arrows to go to the previous or next page.

Hint

The arrows appear only when needed, i.e., if the currently selected page has a previous or next page.

Summary ¶

This page presents summaries for the logs produced by the UTM, separated by days. Unlike the other parts of the log section, it has its own settings to control the level of details shown. The following control elements are available in the first box at the top of the page.

Date Selector: Click inside this field to get a date selector pop-up which allows you to select the day, month and year you wish to view. Once a new date is selected the data on the page will automatically update.
<- Older, Newer ->: Browse the history, moving to the previous or next day. The content of the page will be automatically refreshed.
Export: When clicking on this button, a text version of the summary is shown and can be saved on a local filesystem.
Refresh (Icon): Immediately refresh the content of the page for the given Date selection. This is useful to see monitor updates in real time.

Below the Settings box, a variable number of boxes appears, depending on the running services that have log entries. The Disk Space box should at least be visible, showing the available disk space on the chosen date, while other boxes that can show up include Firewall, DHCP Server, and SSHD.

Note that the summaries are not available for the current day, as they are generated nightly from the log files generated the day before.

Services ¶

Changed in version 6.0: The OpenVPN service has been moved to its own page.

Changed in version 6.0: New widgets to search within log files.

IDS ¶

In this section appear the log entries for the IDS service. The following options are available, to search within the log files.

Type to Filter…: Type a pattern that will be used to retrieve only the log messages containing it.
Date Selector: Show log entries only on the selected date. Click on the current date to open a dialog window that allows to choose other dates. Only dates in which log files have been produced are selectable; the other are greyed out. To search for previous months or years, click on the month or year.

Note

Log files are rotated daily during the night. If at that time the UTM is powered off, no rotation takes place and all the entries in the log file will be considered as today’s entries, even if they were generated on the previous day(s).
Older, Newer: These two buttons allow to browse older or newer entries of the search results by clicking on them.
Export: A click on this button will download the log file.

Note

The name of the downloaded file includes the UTM's hostname, the path to the log file, and the day on which it was exported; its suffix will be .log. Example: efw-endian_var_log_messages_20190627.

At the bottom of the page, two additional controls are available, one on the left-hand side, the other on the right-hand side.

Total, Items/page: The total number of lines in the log file is shown, together with the current pagination value, that can be changed to display less or more messages per pages.
Jump to Page: If log file becomes quite long, or the pagination value is low, or both, the log file will be displayed in multiple pages. Click on the number of the page or on one on the arrows to go to the previous or next page.

Hint

The arrows appear only when needed, i.e., if the currently selected page has a previous or next page.

ClamAV ¶

In this section appear the log entries for the ClamAV service. The following options are available, to search within the log files.

Type to Filter…: Type a pattern that will be used to retrieve only the log messages containing it.
Date Selector: Show log entries only on the selected date. Click on the current date to open a dialog window that allows to choose other dates. Only dates in which log files have been produced are selectable; the other are greyed out. To search for previous months or years, click on the month or year.

Note

Log files are rotated daily during the night. If at that time the UTM is powered off, no rotation takes place and all the entries in the log file will be considered as today’s entries, even if they were generated on the previous day(s).
Older, Newer: These two buttons allow to browse older or newer entries of the search results by clicking on them.
Export: A click on this button will download the log file.

Note

The name of the downloaded file includes the UTM's hostname, the path to the log file, and the day on which it was exported; its suffix will be .log. Example: efw-endian_var_log_messages_20190627.

At the bottom of the page, two additional controls are available, one on the left-hand side, the other on the right-hand side.

Total, Items/page: The total number of lines in the log file is shown, together with the current pagination value, that can be changed to display less or more messages per pages.
Jump to Page: If log file becomes quite long, or the pagination value is low, or both, the log file will be displayed in multiple pages. Click on the number of the page or on one on the arrows to go to the previous or next page.

Hint

The arrows appear only when needed, i.e., if the currently selected page has a previous or next page.

System ¶

In this section appears the log viewer for the system log file, /var/log/messages and will contain all the entries since the last time it was rotated. The following options are available.

Section: Choose from the drop-down menu which logs should be displayed, either All or only those related to a given service or daemon. Among others, they include kernel and system messages, SSH, NTP, and DHCP.

Type to Filter…: Type a pattern that will be used to retrieve only the log messages containing it.
Date Selector: Show log entries only on the selected date. Click on the current date to open a dialog window that allows to choose other dates. Only dates in which log files have been produced are selectable; the other are greyed out. To search for previous months or years, click on the month or year.

Note

Log files are rotated daily during the night. If at that time the UTM is powered off, no rotation takes place and all the entries in the log file will be considered as today’s entries, even if they were generated on the previous day(s).
Older, Newer: These two buttons allow to browse older or newer entries of the search results by clicking on them.
Export: A click on this button will download the log file.

Note

The name of the downloaded file includes the UTM's hostname, the path to the log file, and the day on which it was exported; its suffix will be .log. Example: efw-endian_var_log_messages_20190627.

At the bottom of the page, two additional controls are available, one on the left-hand side, the other on the right-hand side.

Total, Items/page: The total number of lines in the log file is shown, together with the current pagination value, that can be changed to display less or more messages per pages.
Jump to Page: If log file becomes quite long, or the pagination value is low, or both, the log file will be displayed in multiple pages. Click on the number of the page or on one on the arrows to go to the previous or next page.

Hint

The arrows appear only when needed, i.e., if the currently selected page has a previous or next page.

Firewall ¶

The firewall log viewer contains the messages that record the firewall’s activities.

The following options are available, to search within the log files.

Type to Filter…: Type a pattern that will be used to retrieve only the log messages containing it.
Date Selector: Show log entries only on the selected date. Click on the current date to open a dialog window that allows to choose other dates. Only dates in which log files have been produced are selectable; the other are greyed out. To search for previous months or years, click on the month or year.

Note

Log files are rotated daily during the night. If at that time the UTM is powered off, no rotation takes place and all the entries in the log file will be considered as today’s entries, even if they were generated on the previous day(s).
Older, Newer: These two buttons allow to browse older or newer entries of the search results by clicking on them.
Export: A click on this button will download the log file.

Note

The name of the downloaded file includes the UTM's hostname, the path to the log file, and the day on which it was exported; its suffix will be .log. Example: efw-endian_var_log_messages_20190627.

At the bottom of the page, two additional controls are available, one on the left-hand side, the other on the right-hand side.

Total, Items/page: The total number of lines in the log file is shown, together with the current pagination value, that can be changed to display less or more messages per pages.
Jump to Page: If log file becomes quite long, or the pagination value is low, or both, the log file will be displayed in multiple pages. Click on the number of the page or on one on the arrows to go to the previous or next page.

Hint

The arrows appear only when needed, i.e., if the currently selected page has a previous or next page.

VPN ¶

New in version 6.0: This section has been moved from under the Logs and Reports ‣ Services menu and logs for OpenVPN server, client, and IPsec are separated.

This section contains the log files for the OpenVPN server, OpenVPN client, and IPsec services, each in its own subsection. In all the sections, the following options are available.

Type to Filter…: Type a pattern that will be used to retrieve only the log messages containing it.
Date Selector: Show log entries only on the selected date. Click on the current date to open a dialog window that allows to choose other dates. Only dates in which log files have been produced are selectable; the other are greyed out. To search for previous months or years, click on the month or year.

Note

Log files are rotated daily during the night. If at that time the UTM is powered off, no rotation takes place and all the entries in the log file will be considered as today’s entries, even if they were generated on the previous day(s).
Older, Newer: These two buttons allow to browse older or newer entries of the search results by clicking on them.
Export: A click on this button will download the log file.

Note

The name of the downloaded file includes the UTM's hostname, the path to the log file, and the day on which it was exported; its suffix will be .log. Example: efw-endian_var_log_messages_20190627.

At the bottom of the page, two additional controls are available, one on the left-hand side, the other on the right-hand side.

Total, Items/page: The total number of lines in the log file is shown, together with the current pagination value, that can be changed to display less or more messages per pages.
Jump to Page: If log file becomes quite long, or the pagination value is low, or both, the log file will be displayed in multiple pages. Click on the number of the page or on one on the arrows to go to the previous or next page.

Hint

The arrows appear only when needed, i.e., if the currently selected page has a previous or next page.

Proxy ¶

The proxy log viewer shows the logs for the four daemons that use the proxy. Each of them has its own tab: squid (HTTP), icap (Content filter), sarg (HTTP report), and smtpd (SMTP, email proxy).

HTTP ¶

In addition to the common actions, the log viewer for the HTTP proxy allow these values to be specified:

Source IP: Show only the log entries containing the selected source IP address, chosen from a drop-down menu.

Note

The IP addresses available in the drop-down menu depend on those recorded in the log files. The ALL value is the default.
Ignore filter: A regular expression that filters out all the log entries that contain it.
Enable ignore filter: Tick this checkbox to enable the ignore filter.
Restore defaults: A click on this button will restore the default search parameters.

The log entries shown are those produced by the squid software.

Content filter ¶

This tab contains the same settings as the previous HTTP tab and shows log entries of the content filter engine.

HTTP Report ¶

The HTTP report tab has only one option:

Enable: Tick the checkbox to enable the proxy analysis report generator and clicking on the Save button.

Once the report generator is activated, periodic reports are generated and accessible by clicking on the Daily report, Weekly report, and Monthly report links.

SMTP ¶

Only the common actions are available in the tab of the postfix daemon. The log entries shown are those from the log files generated by the postfix daemon.

Type to Filter…: Type a pattern that will be used to retrieve only the log messages containing it.
Date Selector: Show log entries only on the selected date. Click on the current date to open a dialog window that allows to choose other dates. Only dates in which log files have been produced are selectable; the other are greyed out. To search for previous months or years, click on the month or year.

Note

Log files are rotated daily during the night. If at that time the UTM is powered off, no rotation takes place and all the entries in the log file will be considered as today’s entries, even if they were generated on the previous day(s).
Older, Newer: These two buttons allow to browse older or newer entries of the search results by clicking on them.
Export: A click on this button will download the log file.

Note

The name of the downloaded file includes the UTM's hostname, the path to the log file, and the day on which it was exported; its suffix will be .log. Example: efw-endian_var_log_messages_20190627.

At the bottom of the page, two additional controls are available, one on the left-hand side, the other on the right-hand side.

Total, Items/page: The total number of lines in the log file is shown, together with the current pagination value, that can be changed to display less or more messages per pages.
Jump to Page: If log file becomes quite long, or the pagination value is low, or both, the log file will be displayed in multiple pages. Click on the number of the page or on one on the arrows to go to the previous or next page.

Hint

The arrows appear only when needed, i.e., if the currently selected page has a previous or next page.

Log settings ¶

This page contains global configuration options for the UTM‘s logging facility.

Settings

The available options are grouped into three categories: Log summaries, Remote logging, and Firewall logging.

Changed in version 6.0: The Log viewing options have been removed from here and are now included in each page of the Log and Reports module.

Log summaries

Keep summaries for: How many days the log summaries are stored on disk before their deletion.
Detail level: The detail level for the log summary: the higher the level, the more log entries are saved and showed. The drop-down menu allows three levels of detail: Low, Medium, and High.

Remote logging

Click on the Disabled switch to enable remote logging. A few options allow to define where to send the log messages.

Note

The remote server must support the latest IETF syslog protocol standards.

Remote server address: The IP address of the remote syslog server, to which the logs will be sent.
Remote server port: The port on the remote server that accepts incoming syslog connection.

Hint

By default, syslog listens on port 514 UDP.
Protocol: Select from the drop-down menu if the communication to the remote syslog server should use UDP or TCP.

Firewall logging

Log packets with BAD constellation of TCP flags: If this option is enabled the firewall will log packets with a bad constellation TCP flag (e.g., all flags are set).
Log NEW connections without SYN flag: With this option enabled, all new TCP connections without SYN flag will be logged.
Log refused packets: All the refused packets will be logged by the firewall, if this option is enabled.

Growing Logging Files and Disk Space Management

The log files on the UTM are stored on a dedicated partition, under the /var/log/ (today’s log files) and /var/log/archives directories. Every night files are rotated -compressed and moved to the /var/log/archives directory. During the rotation, if the the partition is about to run out of space, the older log files are deleted, to make room for the new ones.

However, when the partition runs out of space during the day, for example because log is active for many services and there is a high volume of traffic, no log file will be recorded anymore. This might render the system unstable and may lead to the impossibilities to start new services or even refuse connections.

In case the log archives are important and the partition is always full, it is suggested to regularly copy the log archives from the UTM to a safe place where to store them and remove them from the UTM. As an alternative, the setup of a remote syslog server is a viable alternative.

Trusted Timestamping ¶

Trusted timestamping is a process that log files (but in general any document) undergo in order to track and certify their origin and compliance to the original. In other words, trusted timestamping allows to certify and verify that a log file has not been modified in any way by anyone, not even the original author. In the case of log files, trusted timestamping proves useful for example, to verify the accesses to the system or the connections from the VPN users, even in cases of independent audits.

Trusted timestamping is not enabled by default, but its activation only requires a click on the grey switch. When it turns green, some configuration options will show up.

Timestamp server URL: The URL of the timestamp server (also called TSA) is mandatory, since it will be this server that signs the log files.

Note

A valid URL of a valid TSA is needed to be able to use trusted timestamping. Several Companies can supply this kind of service.
HTTP authentication: If the timestamp server requires to authenticate, tick the box below the HTTP authentication label.
Username: The username used to authenticate on the timestamp server.
Password.: The password used to authenticate on the timestamp server.
Public key of the timestamping server: To ease and to make the communication with the server more secure, the server’s public key can be imported. the certificate file can be searched on the local computer by clicking on the Browse… button, and then uploaded to the UTM by clicking on the Upload button. After the certificate has been stored, next to the Public key of the timestamping server label, a Download link will appear, that can be clicked to retrieve the certificate, for example if it should be installed on another UTM.

After clicking on the Save button, the settings are stored and, on the next day, a new button will appear in the Logs section, on the right-hand side of the Settings box:

Verify log signature: When clicked it will show a message in a yellow callout to inform about the status of the log.