SELECT version() AS version
SELECT routine_schema from INFORMATION_SCHEMA.routines where routine_name = 'wfwl_inet_pton'
SELECT count(*) FROM webfwlog.services LIMIT 1
SHOW COLUMNS FROM webfwlog.hostnames LIKE 'ip_addr';
SELECT oob_family FROM ulogd.ulog LIMIT 1;
SELECT ip_saddr_bin FROM ulogd.ulog LIMIT 1;
SHOW COLUMNS FROM ulogd.ulog LIKE 'ip_saddr_bin';
SHOW COLUMNS FROM ulogd.ulog LIKE 'icmp_gateway';
SELECT local_time FROM ulogd.ulog LIMIT 1
SELECT oob_family FROM ulogd.ulog LIMIT 1
SELECT _id FROM ulogd.ulog LIMIT 1
SELECT mac_str FROM ulogd.ulog LIMIT 1
Webfwlog 
SELECT last_saved, last_accessed FROM webfwlog.reports
SELECT count(*) FROM webfwlog.reports
SELECT * FROM webfwlog.reports WHERE code<>'default' ORDER BY last_accessed DESC
Firewall Log Report
SELECT REPORT help
Code Edit Last Accessed Description
last20hosts edit 11/12/2025 12:05:24PM Last 20 Unique Hosts
latest_logged_packets edit 11/08/2025 02:59:29PM Latest logged entries, newest at top
basic_new edit 04/15/2024 03:34:19PM Quick report of packets logged since yesterday with extra column
current_count edit 11/20/2023 12:31:51PM Packets logged today, sorted by number of times logged
PSD edit 02/02/2023 05:50:34PM
mac_addresses edit 01/11/2022 01:59:35PM MAC address
last_24_hours edit 09/11/2021 08:23:16PM Last 24 hours, summarized and sorted by protocol and port
everything edit 01/27/2021 01:13:54PM Everything selected
last_24_hours_by_latest edit 05/30/2020 04:31:27PM Last 24 hours, summarized and sorted by latest hit
amost_everything edit 05/24/2020 02:26:19PM
icmp edit 10/02/2019 10:59:28AM Logged icmp packets in the last week
dport_123 edit 11/03/2018 02:48:55PM packets with dport= 123
icmp_v6 edit 04/10/2016 04:33:34PM ICMP v6 packets
current_dport edit 04/06/2016 10:03:36AM packets logged today, sorted by ip protocol and destination port
current_dportx edit 04/08/2014 05:05:59PM packets logged today, sorted by ip protocol and destination port
dport_53 edit 11/18/2012 01:52:47PM packets with dport= 53
protocol_ipv6 edit 10/26/2012 09:10:47PM Protocol 41 (ipv6)
dport_3389 edit 08/04/2010 11:37:12AM packets with dport= 3389
current_dport_test edit 07/10/2010 11:52:23AM packets logged today, sorted by ip protocol and destination port
basic edit 06/28/2010 03:04:15PM Quick report of packets logged since yesterday
unknown_entries edit 11/13/2009 08:05:08AM Entries with ?? in log label
test edit 10/17/2009 03:59:23PM Summarized activity since yesterday
nothing edit 10/11/2009 05:30:10PM
latest_with_resolved edit 10/05/2009 05:16:17PM Latest logged entries, newest at top
FWMARK edit 10/21/2008 11:38:20AM Mark
sport_53 edit 03/31/2007 01:02:41PM packets with sport = 53
defaultx edit 07/18/2006 08:00:17PM Summarized activity since yesterday
tcpsyn edit 02/23/2006 08:55:29AM TCP packets with only the SYN bit set summarized and sorted by port
all_time_by_proto_port edit 02/22/2006 08:13:41PM Last 24 hours, summarized and sorted by latest hit
LW_dport edit 06/02/2005 07:48:38AM Last week by dport
sshd edit 05/08/2005 10:28:54PM SSH connection attempts
raw_today edit 04/24/2005 08:18:02AM unsummarized raw log of packets logged today, sorted by ip protocol and destination port
last_24_hours_with_src edit 03/16/2005 08:03:53AM Logged entries in the last 24 hours, summaries by dport
trusted edit 03/01/2005 07:27:06PM Logged entries from trusted subnets
udpports edit 06/06/2004 09:15:10AM Logged packets on udp ports in the last week
recent_active edit 05/29/2004 07:40:32AM Logged activity that has appeared at least 25 times in the last week.
tcpports edit 04/20/2004 08:46:11PM Logged packets hitting common tcp ports in the last week
LW_sport edit 01/25/2004 12:53:10PM Last week by sport
  help             help
Show Select Data Source

User's Guide to Webfwlog

Welcome to the Webfwlog Home Page

Report list
Using the Report Editor you can create, import, modify, and save report difinitions,
and saved report definitions will be listed here. Clicking on the link in the code column
will run the report from the saved definition. If you want to create a link to a report on your desktop
or on another web page you should copy and paste the link that appears here.
Clicking on the link in the edit column will bring up the report editor with the saved settings of
the selected report
Report Editor button
Press the Report Editor button to bring up the report editor with default settings. From there you
can create, import, modify and save report definitions. See the documentation on the Report Editor
page for more information.
Sorting report list
You can change the order in which reports are sorted by selecting the desired column and pressing
the Sort button. You can set the default sort order in the webfwlog.conf file using the report_order
parameter.
Navigating reports
If selected in the report definition using the report editor, some cells will have links that will allow
"drill-down" on the report. Generally, clicking on a link in a report will filter the report by the item
in the cell selected. For example, if you have a report that has tcp, udp and icmp packets included,
clicking on a link in the protocol column that shows "tcp" will redisplay the report with all other
settings the same but showing only rows for tcp packets. You can further filter the report by clicking
on a link in another column. Continuing the example, clicking on a link in the source IP column
will filter the report by the source IP selected, and you will now see a report showing only tcp packets
from that source IP.

One exception to this is the Count column on summarized reports. Clicking on a link in this column
will show an unsummarized report showing the individual logged entries that make up that line. For
example, if the count column shows "12" clicking on the link will show the 12 logged entries.

The other exception is the Packet column, which shows a unique auto-generated id for each logged
packet. Clicking on a link in the Packet column will show all the details for that packet,
whether or not they appear in the report.

Certain columns will never have links because links would not be meaningful. These include
all date/time columns as well as looked-up columns such as hostnames and service names.

In addition, there are always links in the column headings on reports. Clicking on a link in a column
heading will sort the report by that column. Clicking on the column heading again will reverse the order in
which the column is sorted.

There are also "Home" and "Edit this report" links above the report body that can be used
to return to the home page or edit the displayed report definition, respectively.
Update Cache
Press the Update Cache button to update the hostname and services caches immediately.

Please be aware that this may take a LONG time depending upon how many new unique IPs are
found. You may cancel this operation at any time, and any hostnames already
updated will be saved and not need to be updated again.
Select Data Source
You can override the data source of a saved report at runtime. If you see is a link that reads
"Show Select Data Source", clicking it will show the controls and documentation. If you see the
controls and want to hide them click on the "hide" link. You can set whether to show or hide these
controls by default using the show_select_data_source parameter in the webfwlog.conf file.