04-26-2010 01:28 PM
We are trying to run a report that shows all commands on firewalls within a given day for our PCI audits. With the MARS, any command other than show, obviously gives the above output in the email sent to managers and you must log in to see the actual commands. This can get very tedious if several commands were inputted that day. Is there a way to modify the report to actually list the commands instead of giving this generic description?
Thanks,
Michael
04-27-2010 02:32 AM
Have you tried running the report type as "All Matching Event Raw Messages"? It's not 100% clean exactly, but it does include the commands issued.
04-27-2010 07:33 AM
That worked perfectly.
Thanks,
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide