User guide

Chapter 14: Reviewing and Working with Log Files
192 WatchGuard Firebox System
The log file to which the WSEP is currently writing records can be named
in two ways. If the Firebox has a friendly name, the log files are named
FireboxName timestamp.
wgl. (You can give your Firebox a friendly name
using the Setup => Name option in Policy Manager.) If the Firebox does
not have a friendly name, the log files are named FireboxIP timestamp.
wgl.
In addition, the WSEP creates an index file using the same name as the log
file, but with the extension .
idx1. This file is located in the same directory
as the log file. Both the
.wgl and .idx1 files are necessary if you want to
use any monitoring or log display tool. For more information on the log
file names, see the following FAQ:
https://support.watchguard.com/advancedfaqs/log_filename.asp
Viewing Files with LogViewer
The WatchGuard Firebox System utility called LogViewer provides a
display of log file data. You can view all log data page by page, or search
and display by keyphrases or specific log fields.
Starting LogViewer and opening a log file
From Control Center:
1 Click the LogViewer icon (shown at right).
LogViewer opens and the Load File dialog box appears.
2 Browse to select a log file. Click Open.
By default, logs are stored in a subdirectory of the WatchGuard
installation directory called \logs. LogViewer opens and displays
the selected log file.
Setting LogViewer preferences
You can adjust the content and format of the display. From LogViewer:
1 Select View => Preferences.
2 Configure LogViewer display preferences as you choose.
For a description of each control on the General tab, right-click it and then click
What’s This?. You can also refer to the “Field Definitions” chapter in the
Reference Guide.
For information on the Filter Data tab, see “Displaying and Hiding Fields” on
page 195.