You need to use the "VPN-1" filter, not the "SecureClient" filter, and also
filter on the Remote Access community. The "SecureClient" filter just seems
to show Alert entries from the Desktop Security policy.
Ray
From: Patrick Marquetecken <patrick.marquetecken AT PANDORA DOT BE>
Reply-To: Mailing list for discussion of Firewall-1
<FW-1-MAILINGLIST AT AMADEUS.US.CHECKPOINT DOT COM>
To: FW-1-MAILINGLIST AT AMADEUS.US.CHECKPOINT DOT COM
Subject: [FW-1] Log problem
Date: Wed, 29 Dec 2004 15:54:38 +0100
Hi,
I need to write a script for monitor the secureclient access every month,
so i dit a log export of 2004-12-11 a day i was connected the whole day
with secure client from home.
Because I din't saw any entries in this log, I opended in smart tracker the
file 2004-12-11_235900.log witch must contain some this information.
I was surpriced that here was also no entry of my presence of that day!! I
uses the filter "secure client", so I start to open every log from
2004-12-12 until now and i saw my first entry on the log of
2004-12-16_235900.log, showing as date 11 Dec.
Has this behavoiur to do with the log rotation ?
What i have seen in the logs are only rejects, good connections i seem not
to see so it this possibe to see the "good" connection in the log files?
In the rule i have "LOG" or must i take another approch?
TIA
Patrick
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV AT amadeus.us.checkpoint DOT com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner AT ts.checkpoint DOT com
=================================================
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV AT amadeus.us.checkpoint DOT com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner AT ts.checkpoint DOT com
=================================================
|
