No interface traffic analysis in elog due to the filtering rules

Publication Date:  2014-06-30 Views:  384 Downloads:  0
Issue Description
A customer added Secospace USG 5520S firewall in VSM, and USG 5520S was synchronized. But the customer replied that in the menu ”Analysis->Traffic Analysis ->Interface Traffic”  he can see nothing.
This is the topology:

The related configuration in USG5520S:
info-center source default channel 2 log state off
info-center loghost source GigabitEthernet0/0/2
info-center loghost 10.110.1.178 9002
#
firewall session log-type binary host 1 10.110.1.178 9002
firewall session log-type binary source 10.80.15.251 1616
#
#
firewall statistic system enable
firewall log stream enable
#
firewall interzone trust untrust
session log enable acl-number 3046 inbound
session log enable acl-number 3046 outbound
Alarm Information
None
Handling Process
(1) From the customer’s reply, the route between USG5520S and elog is OK, and the USG5520S was added to elog successfully.

Since interface traffic analysis is based on syslog, check the log collection mode, the connection mode has included syslog, and the port is 514, which is same as that in firewall.

(2) Check the time and time zone, we found that they are same between USG5520S and elog Server.
(3) Check if there was interface traffic in USG5500, and the answer is YES.


(4) Check if elog received the traffic syslogs. We can see in the menu ”Analysis->Network Security Analysis ->Event Monitor” that elog can receive traffic log from USG5520S. After we confirmed from R&D that the format of the traffic logs is correct.

(5) Checked the filtering rules, and found that the customer configured to filter traffic logs by mistake in filtering rules.

(6) After cleared the filtering rules, logs and report of traffic can be queried by eLog.

Then the customer could see the result in menu ”Analysis->Traffic Analysis ->Interface Traffic” .
Root Cause
1) The USG5500 is not associated to elog collecter, or the collection mode didn’t include syslog mode.
2) The time or time zone is not corresponding between USG5500 and elog collecter.
3) The USG5500 didn’t send syslogs to elog collecter, or there is no interface traffic in USG5500.
4) There are filtering rules configured in elog.
Suggestions
When there is issue that some report can’t be seen in elog, you can follow the several steps to troubleshoot.
The cause may be one of the follows:
1) The USG5500 is not associated to elog collecter, or the collection mode didn’t include syslog mode.
2) The time or time zone is not corresponding between USG5500 and elog collecter.
3) The USG5500 didn’t send syslogs to elog collecter, or there is no interface traffic in USG5500.
4) There are filtering rules configured in elog.

END