Logs¶
Logs shows log lines from the gateway as they arrive. It is the second tab under Governance.
Choosing a source¶
| Tab | What it contains |
|---|---|
| All | Every source below, interleaved |
| PF Firewall | Packets matched by firewall rules that have logging turned on |
| System | The operating system's log |
| Agent | The edge agent: configuration applies, connection state, self-updates |
| Web filter | DNS queries blocked by web filtering |
Each tab shows how many entries it holds.
Reading the table¶
| Column | Meaning |
|---|---|
| Time | When the line was written. The column menu sorts by time and limits to a date range |
| Src | Which source the line came from: PF, SYS, AGT or WEB |
| Action | What the firewall did (on All and PF Firewall only) |
| Iface | The interface involved (on All and PF Firewall). On the other tabs this column is Process, the program that wrote the line |
| Rule | The firewall rule that made the decision (on All and PF Firewall only) |
| Details | The rest of the line |
Finding a line¶
- Type in Filter logs... to keep only matching lines. If nothing matches, the page shows No log entries matching filter.
- Scroll to load older entries. While more exist, the status bar says Scroll up for older entries.
- If you have scrolled away and new lines arrive, click {count} new entries — jump to latest.
When the PF Firewall tab is empty¶
The firewall writes a log line only for rules that ask for one. Turn on Log on a firewall rule to see its matches here.
An empty tab on a healthy gateway is normal. Most gateways sit behind NAT and their clients only open outbound connections, so nothing is refused. Broadcast and multicast traffic is dropped without logging on purpose.
The Blocked card on the device Overview tells you which case you are in:
| Card says | Meaning | What to do |
|---|---|---|
| Nothing blocked | The device confirms its default deny has matched no traffic. | Nothing |
| Blocked traffic is not being logged | The device blocked traffic but no log entries reached the portal | Investigate: the count is lower than reality |
| Blocks are not being recorded | No rule in this ruleset logs a block. | Turn on Log on the rules you care about |
The same card shows two separate counters, Refused by policy and Noise suppressed, both counted since the firewall was last loaded. The firewall reloads on every configuration apply and every agent restart, so a small number on a recently changed device does not mean the device is idle.
Sending logs elsewhere¶
To send the device's logs to your own collector as well, use Log forwarding on the Monitoring page.