Troubleshooting blocked/dropped ports on Sonicwall firewalls

Question

This post shows how to filter a panda dataframe for length of strings in a column. I am looking for a solution that implements this using query().

df = pd.DataFrame({'A': ['aa','bbb','aaaaa']})
#df.query("len(A) >2")

should drop the first row.

Solution

According to SonicWALL's Log Event Reference Guide, the UTM only logs up to 32k and then flush the logs.

Log Persistence

SonicOS currently allocates 32K to a rolling log buffer. When the log becomes full, it can be emailed to a defined recipient and flushed, or it can simply be flushed. Emailing provides a simple version of logging persistence, while GMS provides a more reliable and scalable method. By offering the administrator the option to deliver logs as either plain-text or HTML, the administrator has an easy method to review and replay events logged.

So, If you wan't to gather enough data to troubleshoot blocked/dropped ports issues you will need to setup either a GMS/Analyzer (Which displays lots of information in a graphical console), or your favorite syslog daemon in a server.

The procedure to enable a syslog server is the same as adding an GMS/Analyzer appliance: https://support.software.dell.com/kb/sw10097

Update:

To get that level of detail with SonicWALL, you definitely will have to deploy a Syslog server. If you don't want to see anything else besides dropped/blocked packets reports, make sure to go to Log > Categories and uncheck all the fields except Network Access.

To have an idea of what kind of information you can expect to find in your syslog server, take a look at this filter:

Comments

[SpacemanSpiff]

What version of SonicOS? There are built-in graphs and reporting to show this.

[Alex]

SonicOS Enhanced 6.1.1.7-24n--CFS-3n

[Alex]

Hi Gabriel, I have mentioned trying Analyzer in the question text. The problem is, I do not see where in Analyzer shows blocked ports. I found blocked sites and blocked intrusion attempts but not blocked (dropped) ports.

[Alex]

@Gabrial, which report in the analyzer shows the dropped packets/sessions, either due to policy or other?

[Alex]

Apologies @Gabriel, name misspelled

[Gabriel Talavera]

@Alex, try going to Analyzers > Log Analyzer and find a filter that suits your need, it's very limited though.