User's Guide to Webfwlog

Welcome to the Webfwlog Home Page

Report list

Using the Report Editor you can create, import, modify, and save report difinitions,
and saved report definitions will be listed here. Clicking on the link in the code column
will run the report from the saved definition. If you want to create a link to a report on your desktop
or on another web page you should copy and paste the link that appears here.
Clicking on the link in the edit column will bring up the report editor with the saved settings of
the selected report

Report Editor button

Press the Report Editor button to bring up the report editor with default settings. From there you
can create, import, modify and save report definitions. See the documentation on the Report Editor
page for more information.

Sorting report list

You can change the order in which reports are sorted by selecting the desired column and pressing
the Sort button. You can set the default sort order in the webfwlog.conf file using the report_order
parameter.

Navigating reports

If selected in the report definition using the report editor, some cells will have links that will allow
"drill-down" on the report. Generally, clicking on a link in a report will filter the report by the item
in the cell selected. For example, if you have a report that has tcp, udp and icmp packets included,
clicking on a link in the protocol column that shows "tcp" will redisplay the report with all other
settings the same but showing only rows for tcp packets. You can further filter the report by clicking
on a link in another column. Continuing the example, clicking on a link in the source IP column
will filter the report by the source IP selected, and you will now see a report showing only tcp packets
from that source IP.

One exception to this is the Count column on summarized reports. Clicking on a link in this column
will show an unsummarized report showing the individual logged entries that make up that line. For
example, if the count column shows "12" clicking on the link will show the 12 logged entries.

The other exception is the Packet column, which shows a unique auto-generated id for each logged
packet. Clicking on a link in the Packet column will show all the details for that packet,
whether or not they appear in the report.

Certain columns will never have links because links would not be meaningful. These include
all date/time columns as well as looked-up columns such as hostnames and service names.

In addition, there are always links in the column headings on reports. Clicking on a link in a column
heading will sort the report by that column. Clicking on the column heading again will reverse the order in
which the column is sorted.

There are also "Home" and "Edit this report" links above the report body that can be used
to return to the home page or edit the displayed report definition, respectively.

Update Cache

Press the Update Cache button to update the hostname and services caches immediately.

Please be aware that this may take a LONG time depending upon how many new unique IPs are
found. You may cancel this operation at any time, and any hostnames already
updated will be saved and not need to be updated again.

Select Data Source

You can override the data source of a saved report at runtime. If you see is a link that reads
"Show Select Data Source", clicking it will show the controls and documentation. If you see the
controls and want to hide them click on the "hide" link. You can set whether to show or hide these
controls by default using the show_select_data_source parameter in the webfwlog.conf file.