Contents

Related Topics

View Device Log Messages

After you connect to WatchGuard WebCenter, you can review the log messages sent from your Fireboxes to your WatchGuard Log Server. Log Manager enables you to see log messages from your device for any period of time you specify, if log messages were generated in the selected time frame. To see log messages for a Firebox as they are generated, in real-time, you can use Firebox System Manager Traffic Monitor. For more information, see Device Log Messages (Traffic Monitor).

When you first connect to WebCenter, the LOG MANAGER > Devices page appears.

Screen shot of the LOGS > Devices page

On the Devices page, all of the Fireboxes that send log messages to your WatchGuard Log Server appear. You can select any device to view the log messages for that device, even if the Connected status is No. When you select a device from the Devices list, the log messages page appears with a log frequency graph at the top of the log messages list that shows the range of log message data for your device. The default setting for the log frequency graph is a bar chart, but you can also view the data in a line chart. You can select to view log messages for a predefined time range, or you can specify a custom time range. You can also filter the list of log messages by type.

The information that is available in the log messages list depends on the log type you select.

Log Type Result Information
Traffic Disposition, Date-Time, Source, Interface, Destination, Port, Interface, Protocol, Policy
Alarm Date-Time, Alarm Name, Message
Event Date-Time, Process, Priority, Message
Diagnostic Date-Time, Process, Message
Statistic Date-Time, Device, Bytes Received, Bytes Sent
All Type, Date-Time, Detailed Message

To see the log messages for a device:

  1. In the Devices list, select the Name of a device.
    The log messages page for the selected device appears, with only the Traffic log messages displayed.

Screen shot of the DEVICECS > Log Messages page

  1. At the top of the page, click an icon to select the type of log messages to view:
    • Traffic
    • Alarm
    • Event
    • Diagnostic
    • Statistic
    • All
      The log messages from the last 60 minutes appear for the log type you selected.
  2. To select a different time range, from the Actions drop-down list, select a preconfigured time range, or specify a custom time range.
    A list of available log messages for the time range you specified appears.
  3. If you selected a predefined time range, click the Refresh icon to refresh the data in the log message list. This retrieves new data for the specified time range from the moment you refresh the data.
    the Refresh icon does not appear if you have specified a custom time range.
    The log message data is updated for the specified time range.
    For example, at 12:40 PM you select a 30 Minute time range and all of the available log messages from 12:10–12:40 PM appear for your selected device. After you review the log message data, at 12:50 PM you want to see updated log messages for the last 30 minutes. Click the Refresh icon and the log message list updates to include log messages from 12:20-12:50 PM.
  4. To see a line chart of the log message data, click the Line Chart icon.
    To see a bar chart of the log message data, click .
    This is the default setting.
  5. To zoom in on a section of the log frequency graph and see a smaller data set, place your mouse cursor over the graph, hold down your left mouse button, and drag the cursor to select a time range.
    The log message list is updated based on your new selection and the Zoom Out icon appears on the log frequency graph.

Screen shot of the Log Frequency Graph Zoom tool on the LOGS > Devices page

  1. To zoom out to the original time range, click the Zoom Out icon.
  2. To see more detailed information about a log message in the list, click that log message.
    A dialog box appears with additional information about the log message you selected.

Screen shot of the Log Detail dialog box

  1. To copy the content of the message, highlight the message text, right-click the highlighted text and select Copy, or press Ctrl+C on your keyboard.

Search Device Log Messages

You can use the Search feature to refine the log messages that appear for any of your devices. For more information about how to run a search for your devices, see Search Device Log Messages.

See a Timeslice Analysis

The Timeslice Analysis chart is a pie chart that shows the total number of log messages, the average arrival rate of log messages (per minute or per second), and the percentage of each type of log message sent to the Log Server from a Firebox in the specified time range. The Timeslice Analysis is not available for log messages from your servers.

To see a Timeslice Analysis for a device:

  1. In the Devices list, select the Name of a device.
    The log messages page for the selected device appears, with only the Traffic log messages displayed.
  2. From the Actions drop-down list, select Timeslice Analysis.
    The Timeslice Analysis chart appears in a new dialog box.

Screen shot of the Timeslice Analysis dialog box

Export Log Messages

You can export the log messages for any device in the Devices list to a CSV file. When you export log messages, a CSV file is created with the log messages that were available for the device you selected in the time range you specified. This CSV file is automatically added to a ZIP file. The file name of the CSV file included in the ZIP file is the date and time range for the log messages in the file.The ZIP file name is the serial number of the device, as well as the date and time range for the log messages. If you choose to save the ZIP file to a location on your computer, you can specify any file name.

  1. In the Devices list, select the Name of a device.
    The log messages page for the selected device appears.
  2. From the Actions drop-down list, select Export logs (.csv).
    An Opening file dialog box appears for the ZIP file.
  3. Select whether to open the ZIP file or save it to a location on your computer.
  4. Click OK.
  5. If you save the file, browse to select a location.
  6. (Optional) Type a file name for the ZIP file.
  7. Click Save.
    The ZIP file is saved to the specified location on your computer.
  8. Browse to the location where you saved the ZIP file and open the file.
  9. Extract the CSV file.

You can now open the CSV file and review the log messages, or import the CSV file to another program.

See Also

See Log Messages & Reports in WebCenter

Connect to WatchGuard WebCenter

About Logging, Log Files, and Notification

About Notification

Set Up Your Log Server

Set Up Your Report Server

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.