I am finding this software to be far more difficult to use/understand than other competing products. We purchased a full license for this recently and I'm really frustrated.
By default, everything is sent to a log file. That's fine. But, when running the GUI interface, after reading the help file and stuff online, I still cannot figure out how to filter based on a given IP address. I don't understand if I need to create an entire new rule, filter, action, some of it, or all of it. I want everything to be logged to file. But at times, I only want to VIEW syslog messages coming from a single IP/device. How is this done!? Please don't direct me to the help file or online knowledge base because I've gone through this and found it extrmely confusing. A different syslog product I work work, all I have to do is right click on the event log in the GUI and a context window comes up which allows me to temporarily filter ONLY on that device. Kiwi's filtering process is a real pain IMHO.
Can someone explain this better and provide a walk through or something? Also, why can I only view the last 10-1000 events in the syslog viewer? What should I be using to view messages that are not showing in the gui window? We go through 1000+ messages very quickly. I would prefer to see ALL messages from a single IP over the course of the entire log file.
Anyways, hopefully someone can help. All these rules, filters, displays, etc. is frustrating.
