Methods used to export logs of the USG2000, USG5000, and USG6000

2

Methods used to export logs of the USG2000, USG5000, and USG6000:
1. The method used to export logs of the USG6000 is as follows:

Choose Monitor > Logs > Traffic Logs/Threat Logs/URL Logs/Content Logs/Operation Logs/System Logs/User Activity Logs/Policy Matching Logs/Mail Filtering Logs/Audit Logs. Click Export to export system logs in the CSV format to the administrator's PC.

2. The method used to export logs of the USG2000 or USG6000 is as follows:
a. Choose Logs > Log Display > Log Display.
b. Select the Log Display tab.
c. Open or save a log file in the following ways:
1) Click Export. In the displayed File Download dialog box, click Open to view the configuration of the log buffer and log content.
2) Click Save to save the file driver or folder. Click Save.

If the operation is successful, you can view the saved logs in the log export path.

Other related questions:
Method used to input logs of the USG2000, USG5000, and USG6000 to the log server
The method used to input logs of the USG2000, USG5000, and USG6000 to the log server is as follows: 1. Run the system-view command to enter the system view. 2. (Optional) Run the info-center source { module-name | default } channel { channel-number | channel-name } [ log { state { on | off } | level severity }* ] command to add logs to the information channel. By default, the system outputs logs to the log server using information channel 2. The log switch is set to on and the severity is set to informational. You only need to configure this command when you modify the default system configuration. 3. Configure the module-name to set the module that outputs logs. 4. Configure the severity to set the severity of output logs. 5. Bind the information channel with the log server, so that logs can be output to the log server over this channel. 6. Configure the IP address and parameters of the log server. info-center loghost ip-address [ port ] [ module { module-name } &<1-6> ] info-center loghost ip-address [ port ] [ channel { channel-number | channel-name } | facility local-number | language { chinese | english } ]* The channel-number or channel-name must be consistent with that configured in 1. 7. (Optional) Run the info-center loghost source ip-address command to specify the IP address that sends logs.

Method used to output syslog logs of the USG2000, USG5000, or USG6000 to the log server
Method used to output syslog logs of the USG2000, USG5000, or USG6000 to the log server: Configuration procedure: 1. Enable the information center and allow the device to output logs through the information center. 2. Configure the source interface used to send logs. 3. Configure the log output channel to send logs of different modules to the specified log server. 4. Configure the log server to receive logs from the NGFW.

Method used to output logs of the USG2000, USG5000, or USG6000 to the control console
Method used to output logs of the USG2000, USG5000, or USG6000 to the control console This configuration can enable the system to output debugging information to the control console. Context The system outputs debugging information to the control console using console information channel 0. The debugging information switch is set to On, and the verification level is set to debugging. Procedure: Configure the channel for outputting debugging information. On the device where the configuration information center resides, run the system-view command to enter the system view. Run the info-center source { module-name | default } channel { channel-number | channel-name } [ debug { state { off | on } | level severity } * ] command to add debugging information to the information channel. The system can output debugging information only when the information center is enabled. By default, the timestamp of the debugging information is in the boot format. Configure the system to output debugging information to the control console as follows: On the device where the configuration information center resides, run the system-view command to enter the system view. Run the info-center console channel { channel-number | channel-name } command to configure the system to output information to the CON control console. Configure the terminal display function: On the device where the configuration information center resides, run the terminal monitor command to enable the information display function of the terminal. By default, this function is enabled. The preceding command is valid only to the current terminal. Run the terminal debugging command to enable the terminal to display debugging information. Example In the system view, run the info-center source default channel 0 command to add debugging information to information channel 10. For [USG] info-center source default channel 0, run the info-center console channel 0 command to configure the system to output debugging information to CON0 control console. [USG] info-center console channel 0

Method used to view logs of the USG2000 or USG5000
Method used to collect logs using the command lines on the USG2000, USG5000, or USG6000 1. In CLI mode: [USGXXXX]display logbuffer //Collect logs. 2. Collect logs on the web UI: a. Collect logs on the USG2000 or USG5000 as follows: Choose Logs > Log Display, and select the corresponding log type in the right option box. b. Collect logs on the USG6000 as follows: Choose Monitor > Logs > System Logs to view system logs. Note: You cannot query the discarded or overwritten historical logs.

Method used to export policy matching logs on the USG6000
The method used to export policy matching logs on the USG6000 is as follows: 1. Choose Monitor > Logs > Policy Matching Logs. 2. Select Column Customization and select or cancel various types of conditions displayed in policy matching logs. 3. Click Export to export policy matching logs in the CSV format to the administrator's PC.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top