RE: [loganalysis] fwlogwatch feedback

From: Boris Wesslowski (Boris.Wesslowskiat_private-Stuttgart.DE)
Date: Tue Aug 28 2001 - 09:23:11 PDT

  • Next message: lbuchanaat_private: "[loganalysis] Central syslog server best practices (revisited)"

    > I've tried it out on a limited basis and have had good results with Cisco
    > IOS output, but it doesn't seem to even detect my PIX logs, let alone
    > report on them correctly.  PIX 5.2.
    
    The log format of the PIX was changed recently, fwlogwatch doesn't
    recognize the new one yet. It can report denied packets from the old
    format, but ignores any other log messages because the format is very
    inconsistent. I don't know if you like to read it but if you try to write
    a regexp parser generator for that mess you'll understand...
    
    
    Regards
    -- 
    Boris Wesslowski                    Rechenzentrum Universitaet Stuttgart
    RUS Security Team & CERT - Sneakers         http://cert.uni-stuttgart.de
    Boris.Wesslowskiat_private-Stuttgart.DE  Tel: +49 711 685 5973 / Fax: 5898
    PGP : http://ca.uni-stuttgart.de:11371/pks/index?search=Boris.Wesslowski
    
    ---------------------------------------------------------------------
    To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    For additional commands, e-mail: loganalysis-helpat_private
    



    This archive was generated by hypermail 2b30 : Tue Aug 28 2001 - 13:34:34 PDT