Open nw3000 opened 7 months ago
it is hard to find out which specific rule actually trigged in logs when debugging why one stream been blocked or allowed:
2024-03-24T05:19:32Z INFO UDP stream action {"id": 1771768123415990016, "src": "192.168.1.2:36877", "dst": "84.1.1.1:9993", "action": "allow", "noMatch": true} 2024-03-24T05:19:45Z INFO TCP stream action {"id": 1771768812341536768, "src": "192.168.1.2:37245", "dst": "12.1.1.1:443", "action": "block", "noMatch": false}
is that possible you can enriching the log or debug output to add more info? something like
2024-03-24T05:19:32Z INFO UDP stream action {"id": 1771768123415990016, "src": "192.168.1.2:36877", "dst": "84.1.1.1:9993", "action": "allow", "noMatch": true, "reason": implicit default allow} 2024-03-24T05:19:45Z INFO TCP stream action {"id": 1771768812341536768, "src": "192.168.1.2:37245", "dst": "12.1.1.1:443", "action": "block", "noMatch": false, "reason": - name: block some site https - rules.yaml line 103 }
thank you.
Good suggestion. For now you can also add log: true to each entry, which essentially does the same thing
log: true
it is hard to find out which specific rule actually trigged in logs when debugging why one stream been blocked or allowed:
is that possible you can enriching the log or debug output to add more info? something like
thank you.