Skip to main content
thegost4u
thegost4u
New Member
February 23, 2015
Question

DLP log only mode is not working !!

  • February 23, 2015
  • 3 replies
  • 8051 views

Hello all !

IN DLP, i have a sensor which checks if files has the word "test", and the action is "log only", but it does not show anything in logs when i pass files.. why ??

i have enabled extended-utm-logs already.

my device is 100D and the software is v5.0,build0310 (GA Patch 11) [was on latest 5.3 and downgraded]

here is a screenshots of my current situation:

 

 

 

 

See it only logs when i set action to "block"

 

    3 replies

    thegost4u
    thegost4uAuthor
    New Member
    February 25, 2015

    Ok, i made it work.. this is what i changed 

     

    config dlp sensor edit "test" set comment "This is a test sensor" set replacemsg-group '' config filter edit 1 set type file set proto smtp pop3 imap http-post ftp nntp mapi set filter-by regexp set regexp "(T|t)(E|e)(S|s)(T|t)" set action log-only next end set extended-utm-log enable set dlp-log enable set nac-quar-log enable set flow-based disable unset options set full-archive-proto smtp pop3 imap http-get http-post ftp nntp aim icq msn yahoo mapi unset summary-proto next end

     

     

    so others can make use of it in future ! 

    thanks all for not helping :\ 

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    February 25, 2015

    hey,

     

    no need to be rude, especially not here in a self-help forum. I get it that this upset you but you resolved the issue by yourself within 24 hours. I've been on a recent problem for more than 4 months until I found the solution, and didn't whince (much).

     

    Back to your filter. If you are using an RE you can use the "i" switch to make the pattern case-insensitive, like in

    "i/test/". FortiOS RE follow the perl syntax as far as I remember so switches should be included.

    Maybe that'll help you in the future.

    thegost4u
    thegost4uAuthor
    New Member
    February 25, 2015

    ede_pfau wrote:

    hey,

     

    no need to be rude, especially not here in a self-help forum. I get it that this upset you but you resolved the issue by yourself within 24 hours. I've been on a recent problem for more than 4 months until I found the solution, and didn't whince (much).

     

    Back to your filter. If you are using an RE you can use the "i" switch to make the pattern case-insensitive, like in

    "i/test/". FortiOS RE follow the perl syntax as far as I remember so switches should be included.

    Maybe that'll help you in the future.

     

    Sorry for misunderstanding, i was implying that am sad not rude ^^

    back to my filter, thanks for the case sensitive help ! i've been working so fast on it and i can't focus everywhere.

    so if i want to apply a filter for "secret document" (in both capital and small letters) what do you advice to use as regex ?

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    February 25, 2015

    Alright.

    I'd use "i/secret document/" but be aware that there is meant to be only 1 space between words.

    "i/secret\s+document/" would match variable spaces or tabs between words.

    Terms & ConditionsAccessibility statement