69 lines
1.9 KiB
Markdown
69 lines
1.9 KiB
Markdown
# POC现场：安全策略失效后，界面仍有对应的安全日志
|
||
|
||
| ID | Creation Date | Assignee | Status |
|
||
|----|----------------|----------|--------|
|
||
| OMPUB-569 | 2022-07-26T13:27:43.000+0800 | 刘学利 | 已关闭 |
|
||
|
||
|
||
---
|
||
|
||
POC现场，策略ID为262的策略于7月25日下午失效，7月26日上午发现安全日志界面出现了几条新的安全策略日志
|
||
!image-2022-07-26-13-27-25-410.png|thumbnail!
|
||
!image-2022-07-26-13-27-38-811.png|thumbnail! **liuxueli** commented on *2022-07-26T14:42:14.404+0800*:
|
||
|
||
* [~zhangzhihan] 提供展开的安全日志详情，策略生效与失效的具体时间。
|
||
|
||
|
||
|
||
---
|
||
|
||
**daikaiqiang** commented on *2022-07-26T15:04:42.234+0800*:
|
||
|
||
!image-2022-07-26-13-34-29-057.png!
|
||
|
||
|
||
|
||
---
|
||
|
||
**daikaiqiang** commented on *2022-07-26T15:25:22.691+0800*:
|
||
|
||
!image-2022-07-26-13-55-17-049.png!
|
||
|
||
|
||
|
||
---
|
||
|
||
**liuxueli** commented on *2022-07-29T13:36:55.751+0800*:
|
||
|
||
* [~zhangzhihan] [~daikaiqiang] 需要提供安全策略失效后，界面仍有对应的安全日志详情。
|
||
** 查看日志详情目的：命中monitor动作需等到链接结束才会发送日志，判断日志详情中的Start Time时间对比start time与策略失效时间：
|
||
*** Start Time早于策略失效时间，则属于正常现象；
|
||
**** 命中monitor动作的链接(session)会记录本链接命中策略状态，即使策略失效链接结束时也会发送日志
|
||
*** Start Time晚于策略失效时间，则属于异常现象，需要继续排查
|
||
** https://docs.geedge.net/pages/viewpage.action?pageId=23037225#Firewall%E6%95%85%E9%9A%9C%E6%8E%92%E6%9F%A5-%E7%AD%96%E7%95%A5%E5%A4%B1%E6%95%88%E5%90%8E%E4%BB%8D%E6%9C%89%E6%97%A5%E5%BF%97%E4%BA%A7%E7%94%9F
|
||
|
||
|
||
|
||
---
|
||
|
||
|
||
|
||
## Attachments
|
||
|
||
**29835/image-2022-07-26-13-27-25-410.png**
|
||
|
||
---
|
||
|
||
**29834/image-2022-07-26-13-27-38-811.png**
|
||
|
||
---
|
||
|
||
**29837/image-2022-07-26-13-34-29-057.png**
|
||
|
||
---
|
||
|
||
**29838/image-2022-07-26-13-55-17-049.png**
|
||
|
||
---
|
||
|