A network administrator is troubleshooting an issue where a newly deployed custom report is not generating any data, even though there should be relevant log entries. The administrator suspects an issue with the report's filter criteria. Which method is most effective for validating the filter criteria against existing logs to ensure it will capture the intended data?
- ACopy the filter criteria to the Traffic log filter field and apply it.
- BRun a 'test' report with a smaller time range.
- CCheck the 'Policies > Security' tab for logging settings.
- DReview the firewall's System logs for report generation errors.
Show answer & explanationAnswer & explanation
Correct answer: A. Copy the filter criteria to the Traffic log filter field and apply it.
The most effective way to validate report filter criteria is to directly apply the same filter string to the relevant log type (e.g., Traffic logs) under 'Monitor > Logs'. This allows the administrator to see in real-time which log entries match the filter, confirming its correctness before running the full report.
Why the other options are wrong
- B. Running a test report is less efficient than direct log filtering and doesn't provide immediate feedback on filter correctness.
- C. Logging settings in security policies determine *if* logs are generated, not whether a custom report's filter *matches* existing logs.
- D. System logs might indicate report *generation* errors, but not issues with the *logic* of the filter criteria itself.
Custom Report Filter Validation
To validate custom report filter criteria, copy the exact filter string and apply it directly to the corresponding log type's filter bar in the 'Monitor > Logs' section of the firewall GUI. This provides real-time feedback on matching log entries.
- Ensures the filter syntax is correct and logically sound.
- Allows immediate visual confirmation of matching log entries.
- Prevents wasting resources on generating empty or incorrect reports.
Memory trick: For a 'report filter' that's 'broken', 'copy' it to 'logs' and see what's 'spoken'!