Palo Alto Networks Knowledgebase: Generate Traffic Report with Filters on the PAN-OS CLI

Generate Traffic Report with Filters on the PAN-OS CLI

5707
Created On 02/08/19 00:06 AM - Last Updated 02/08/19 00:06 AM
Device Management Initial Configuration Installation QoS Zone and DoS Protection
Resolution

Details

To generate a traffic report applying filters on the CLI, use the following command:

> show log traffic query equal <value>

 

For Example:

> show log traffic query equal "(port.dst eq 443) or (port.dst eq 53) or (port.dst eq 445) and (action eq allow)"

 

Example with start and end times:

> show log traffic start-time equal 2013/07/18@13:12:19 end-time equal 2013/08/21@00:00:00 query equal "(port.dst eq 443) or (port.dst eq 53) or (port.dst eq 445) and (action eq allow)"

 

Sample output:

act-5.JPG.jpg

 

To determine the query string for a specific filter, follow the steps below:

  1. On the WebGUI, create the log filter by clicking the 'Add Filter' icon.
    act-1.JPG.jpg
  2. Build the log filter according to what you would like to see in the report. For this example, we are generating traffic log report on port 443, port 53, and port 445 with action set to allow.
    act-2.JPG.jpg
    act-3.JPG.jpg
  3. The filter string will appear on the filter bar as shown in the screenshot below:
    act-4.JPG.jpg

owner: sodhegba



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKtCAK&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language