Safe Access Accessing the raw Blocking Activity log

Currently reading
Safe Access Accessing the raw Blocking Activity log

fredbert

Moderator
NAS Support
Subscriber
5,122
2,072
NAS
DS1520+, DS218+, DS215j
Router
  1. RT2600ac
  2. MR2200ac
  3. RT6600ax
  4. WRX560
Operating system
  1. macOS
Mobile operating system
  1. iOS
The activity log that is managed by Safe Access is held in a SQLite3 database. To access the database you have to enable SSH on the router and login as root using the user admin's password.

I don't advocate anyone messing with this unless they are very confident in what they are doing and don't mind doing a factory rebuild of the router.

There are a number of tables that are used to track the different parts of the activities, e.g. device for MAC addresses and filter_reason for triggered filter texts.

Bash:
NetworkRouter> sqlite3 /var/packages/SafeAccess/etc/synosafeaccesslog/log.db
SQLite version 3.31.1 2020-01-27 19:55:54
Enter ".help" for usage hints.
sqlite> .tables
access_anyway  block_type     domain_block   general        safe_browsing
action         category       filter         ip             threat_type
allow          config_group   filter_reason  ip_protocol    web_filter  
allow_count    device         filter_type    profile    
block_rule     domain         firehol        request    
sqlite> .exit

It should be possible to write sql code to extract the activity log so that it can be processed outside the router.

I tested what happened if I manipulated (i.e. deleted a row) the table data:
  1. I chose a row in the filter_reason table and deleted it: the blocked activities in Safe Access for this filter had blank Domain/IP fields and the Description became, something like, 'Unknown'.
  2. I then chose a row in the device table and deleted it. The result was that the corresponding device's blocked activities in Safe Access were removed.
It looks that the main table is general and then other tables all reference each other via <table name>_id references.

I don't know what the longer term effects will be of my deleting those rows in the tables. Only time will tell.
 

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Welcome to SynoForum.com!

SynoForum.com is an unofficial Synology forum for NAS owners and enthusiasts.

Registration is free, easy and fast!

Back
Top