D-Link NetDefendOS User Manual page 100

Note that it is only possible to filter on a single severity level at once.
• Filter by log ID number:
gw-world:/> logsnoop -on -logid=1500001
All the ID numbers can be found in the separate NetDefendOS Log Reference Guide. Leading
zeros do not need to be specified.
• Filter by Source IP:
gw-world:/> logsnoop -on -srcip=192.168.1.10
Here, the srcip field must exist in a log message for it to be displayed. For example, if the log
message comes from an IP rule, the srcip field of a displayed message will contain the source
IP for the connection that triggered the rule.
• Filter by Source Interface:
gw-world:/> logsnoop -on -srcif=If1
Here, the srcif field must exist in a log message for it to be displayed. For example, if the log
message comes from an IP rule, the srcif field of a displayed message will contain the source
interface for the connection that triggered the rule.
• Filter by combining parameters:
gw-world:/> logsnoop -on -severity=warning -srcip=192.168.1.10 -srcif=If1
Any number of filtering parameters can be used together in a single logsnoop command.
A complete list of command parameters can be found in the entry of logsnoop in the separate
NetDefendOS CLI Reference Guide. Alternatively, the following the CLI command can be used:
gw-world:/> help logsnoop
Filtering Wildcards and Free-text Filtering
When specifying filtering parameters, the following wildcards can be used:
* - An asterisk represents none or many characters.
? - A question mark represents any single character.
For example, to find the text warning followed somewhere by udp, the command would be:
gw-world:/> logsnoop -on -pattern=*warning*udp*
The -pattern parameter specifies a free-text text filter for log messages. Wildcarding can also be
used with other filtering parameters and is not limited to -pattern.
Limiting Log Message Numbers
Even when using filtering, the numbers of messages appearing at the console may still need to
be reduced. The numbers of messages displayed can be limited in two ways:
• Limit by frequency:
Chapter 2: Management and Maintenance
100