Consolidating Logs From Multiple Locations; Copying Log Files - Watchguard Firebox X1000 User Manual

current log files are always open, they cannot be copied,
moved, or merged using traditional copy tools; you should
use WSEP utilities to work with active log files.
Unlike other Firebox System utilities, you cannot access the
WatchGuard Security Event Processor user interface from
Firebox System Manager. To open the WSEP Status/Con-
figuration user interface:
• Right-click the WSEP icon (shown at right) in
the Windows system tray and select WSEP
Status/Configuration. If the WSEP icon does
not appear in the system tray, you can launch the
WSEP from System Manager by selecting Tools = >
Logging => Event Processor Interface.

Consolidating logs from multiple locations

You can merge two or more log files into a single file. This
merged file can then be used with Historical Reports, Log-
Viewer, HostWatch, or some other utility to examine log
data covering an extended period of time. From the WSEP
Status/Configuration user interface:
1
Select File = > Copy or Merge log files.
2 Click Merge all files to one file. Enter the name of the
merged file.
3
Enter the files to merge in the Files to Copy box.
You can also use the Browse button to specify the files.
4 Enter the destination for the files in the Copy to This
Directory box.
5
Click Merge.
The log files are merged and saved to the new file in the
designated directory.

Copying log files

You can copy a single log file from one location to another,
and you can copy the current, active log file. From the
WSEP Status/Configuration user interface:
1 Select File = > Copy or Merge Log Files.
User Guide
Working with Log Files
229