To the "oldies": Question about 4.0 Log Viewer

[dalecooper]

What can I do, if the logviewer shows the wrong name for the interface on which a logged event took place?

I checked the firewall object, it has the interfaces correctly named, but the logviewer confuses eth-s3p3c0 and s1p4c0 for example and sometimes it lists an interface named "if9" that's not even there.

Any ideas appreciated

 

[rn4it]

I don't recall seeing that, check

http://www.phoneboy.com

great site for CP FW1 4.1. You may want to try recreating the object and doing a get. What does your CP fW sit on? You will want this working properly otherwise it may cause other problems

 

[dalecooper]

Thanks for answering. FW-1 is running on a Nokia. I know Phoneboy, of course and the FW-1 mailinglist, but I couldn't find anything there either. I &quot;inherited&quot; this installation and the firewall is working fine, everyone else is just ignoring the interface names, but I consider them important and want to solve this <s>

 

[rn4it]

Do you have support with Nokia? they have a pretty good knowledge base

http://support.nokia.com.

I'll take a look in case you don't, but you may want to get some basic support, even if it's just a one time call. If Checkpoint is not pulling the interfaces correctly then it could lead to other problems.

 

[dalecooper]

The Nokia support contract ran out before I started this job. Money is an issue so they didn't renew it *sigh* AFAIK I can sign into the Nokia site as a &quot;customer with a Nokia product&quot; anyway, all they want is the serial number of the box. I'll try that. Thanks again

Ralf

 

[subliminator16]

FWIW, I don't trust log viewer. I barely trust fw log -ftn from the command line, but that's another issue . The only time I confronted anything like this...and it included wrong or imaginary interface names... was when my excessive log grace period (in FW properties) was set too high and I was trying to log too many similar packets. Once I got the settings right for my network (I'm at 9 seconds at the moment), things settled down alot and became more accurate. But then I'm not running on a Nokia, so this input might not help much. Cheers.

 

[dalecooper]

Hi! Doesn't this value say that although similar packets are handled by the rulebase, only the first of these packets should be logged within the &quot;grace period&quot;? If I decrease this value I will get MORE log entries per similar packets or am I to tired already today to understand it correctly? ;-)