Log packet formatting

Log packet formatting in the debug and filter logs allows further customization of the output to make the logs easier for you to read. This article explains these customization options and how to use them.

  1. In the administration interface, go to Logs > Debug/Filter.
  2. In the context menu, click Format of logged packets.
  3. Type an expression.
  4. Click OK.

Creating expressions

Format of logged packets is defined by special expressions (a template). You can edit this template to get transparent and relevant information.

Default template

The default template for packet logging follows this pattern:

%DIRECTION%, %IF%, proto:%PROTO%, len:%PKTLEN%,
		 %SRC% - %DST%, %PAYLOAD%

Expressions introduced with % are variables. Other characters and symbols represent static text as printed in the log.


The following variables can be used in packet logging templates:

If you wanted to track the direction on an interface, the source and destination and size of the packet:

%DIRECTION% %IF%, %SRC% >> %DST%, length %PKTLEN%

Which would result in the following:

[08/Sep/2012 11:47:39] PERMIT "Firewall traffic" packet from WANWide area network - A network that connects computers and other devices in a large area., >>, length 96
[08/Sep/2012 11:47:39] PERMIT "Firewall traffic" packet to WAN, >>, length 63

If you wanted to also show the protocol that was being used the following would display this:


Which would result in the following:

[08/Sep/2012 16:12:33] PERMIT "Firewall traffic" packet to WAN UDP ( >>
[08/Sep/2012 16:12:33] PERMIT "Firewall traffic" packet from WAN UDP ( >>


After this change has been applied the logs will update with the new view. This change is not retroactive and will not alter the previous format of your log data. This change will be applied to both the Filter and Debug log at the same time, it is not possible to set different customizations for each log.