Re: Sonicwall

The sonicwall service looks pretty old. Flow wise the first thing it does is tries to split off the first 7 pieces


($month,$day,$time,$host_ip,$host_id,$host_sn,$msg)=split(/ +/,$ThisLine,7);

Then parse what is left. Most of them asume the line that is left starts with n= and then src= so it;s 

Off by this
> fw=198.15.66.58 pri=6 c=1024 m=97


The service has a sample log line....

#time="2005-03-23 09:03:27" fw=62.2.84.91 pri=5 c=128 m=37 msg="UDP packet dropped" n=3759 src=64.74.133.26:11379:WAN dst=62.2.84.91:33436:WAN^M
#Mar 23 12:45:32 10.15.30.1 id=firewall sn=004010144097 time="2005-03-23 11:08:20" fw=62.2.84.91 pri=6 c=1024 m=98 n=61505 src=195.143.213.210:4992:WAN dst=62.2.84.92:1802:DMZ proto=tcp/1802 rcvd=106 ^M

Which doesn't line up with yours... So I'd say there was some work to be done.. :(

-Mike


On Jul 12, 2013, at 3:09 AM, Thomas Bernthaler wrote:

> Hi,
> 
> We have a new SonicWall and because I am a long-term user of logwatch I activated the SonicWall service. However it does not parse the info.
> 
> The SonicWall logfile is about 800mb a day, I expected some summary but instead it seems like it packs in pretty much the whole 800mg into an email which of course never arrives.
> 
> Therefore I think it must be a bug, maybe only at SonicWall 215tz since this is the only SonicWall we have so we can not test it against other versions of this firewall.
> 
> Basically the reports has all lined of the logfile unparsed in the report. Looks like this:
> 
> Jul 11 09:54:45 10.0.0.2 id=firewall sn=C0EAE41B3F84 time="2013-07-11 09:54:45" fw=198.15.66.58 pri=6 c=1024 m=97 n=574358 src=50.140.113.63:49941:X1 dst=10.0.83.107:80:X0 proto=tcp/http op=GET sent=1363 rcvd=623 result=0 dstname=www.wf1broward.com arg=/upload/12216/websitebanner%20.jpg  code=64 Category="Not Rated" 
> 
> Jul 11 09:54:46 10.0.0.2 id=firewall sn=C0EAE41B3F84 time="2013-07-11 09:54:46" fw=198.15.66.58 pri=6 c=1024 m=97 n=574360 src=108.206.254.173:49384:X1 dst=10.0.83.107:80:X0 proto=tcp/http op=GET sent=439 rcvd=324 result=0 dstname=www.wf1broward.com arg=/favicon.ico  code=64 Category="Not Rated" 
> 
> Jul 11 09:54:46 10.0.0.2 id=firewall sn=C0EAE41B3F84 time="2013-07-11 09:54:46" fw=198.15.66.58 pri=6 c=1024 m=97 n=574360 src=66.249.73.234:39834:X1 dst=10.0.83.107:80:X0 proto=tcp/http op=GET sent=724 rcvd=4693 result=0 dstname=www.wf1broward.com arg=/Claims_and_Benefits_English/text/SocialNetworkingWorkshop4.htm?date=2013-06-28  code=64 Category="Not Rated" 
> 
> 
> Is there anything I can do or any patch to be applied?
> 
> Best wishes,
> Thomas
> -- 
> DMNI - Global Business Strategies
> (954) 376-4592
> E-Mail: [email protected]
> Internet: http://www.dmni.com
> ------------------------------------------------------------------------------
> See everything from the browser to the database with AppDynamics
> Get end-to-end visibility with application monitoring from AppDynamics
> Isolate bottlenecks and diagnose root cause in seconds.
> Start your free trial of AppDynamics Pro today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk_______________________________________________
> Logwatch-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/logwatch-devel

------------------------------------------------------------------------------
See everything from the browser to the database with AppDynamics
Get end-to-end visibility with application monitoring from AppDynamics
Isolate bottlenecks and diagnose root cause in seconds.
Start your free trial of AppDynamics Pro today!
http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel