Chapter 14 Log

NG-UTM completely logs every action taken by each administrator upon logging into the system, including events of failed login attempts. This facilitates administrators in tracing the operations of themselves or other administrators to ensure normalcy post.

14-1. System Operation Log

14-1-1. Logs

Every administrator with any level of permissions (View, Read, Write, View-Read-Write) will have their actions on NG-UTM recorded.

This includes the timestamp, login account, login IP address, function path, action, and the content of the operation. Events can be retained for up to 12 months.

Clicking on the icon for to change the sorting order.

圖14-1 Logs List

【Time】: The time at which the event takes place.

【Account】: The administrator account performing the action.

【IP Address】: The IP address used by the administrator account.

【Management IP】: The IP address of the firewall interface to check which this account logged in.

【Menu Path】: The path of the management interface accessed by the administrator.

【Action】: The action performed by the administrator, such as login, add, modify, delete, search, download, etc.

【Events Content】: The detailed content before and after the action is executed. NG-UTM will list the differences between the pre-modification and post-modification items.

14-1-2. Logs Search

Searching for records stored in NG-UTM based on specific IP addresses or related event characteristics.

Figure 14-2 Logs Search

【Account】: The system will list all administrator accounts, allowing administrators to select all or specific accounts.

【IP Address】: The IP address of the administrator account.

【Management IP】: The IP address of the firewall.

【Time】: Select the time range for the query.

【Select all】: Select all event or check the event records for the query.