Ayden, However, the SIC trust between webtrends and the management server doesn't guarantee your wentrend LEA client service is able to fetch Firewall log successfully, and something, such as your webtrend box wrong date & time, can also be an issue for your failure.
First of all, you have to make sure that you do see firewall log in your management server log viewer. If not, go check the connection between your management server and firewall. If yes, do they both use the same communication mode, such as sslca, auth_opsec, ...? They have to use the same mode in order to make your webtrend to receive events. You can turn on your server side fw log by "fw debug fwd on OPSEC_DEBUG_LEVEL=3". Then, you start your webtrend, and wait for a few minutes. You stop debugging by running "fw debug fwd off OPSEC_DEBUG_LEVEL=0". Afterwards, you can review fwd.elg under $FWDIR/log. If you want, you can send me this log file, and I can take a look at it. Xiaodong -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Ayden Nash Sent: Friday, July 16, 2004 2:42 AM To: [EMAIL PROTECTED] Subject: [FW-1] OPSEC LEA Hi all, I am trying to use webtrends to generate reports on fw-1 traffic. I am able to establish SIC trust between webtrends and the management server however the logs directory is not being populated. I see the reporting server use FW1_LEA to connect to the management server every 5 minutes and that traffic is allowed, but no logs seem to be obtained. Any ideas are appreciated. Thanks and regards, Ayden ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
