Re: Sonicwall

Hi,

Sorry for the delay, I have looked if I could make some adjustments in 
Sonicwall but it looks like this is a set log in the sonicwall.
If the developers would be interested to do an update so that it works 
with SonicWall 215 firewalls then I would also consider to donate or be 
a sponsor. Depending of the costs it would take to adjust this. These 
SonicWal log-files grow 1 GB+ per day, it is literally impossible to 
analyse them manually.  Logwatch would be the perfect solution to notify 
us of issues since we study our daily Logwatch report deeply.

I am happy to send a larger section of the log file if anyone is interested.

Best wishes,
Thom


On 7/12/2013 9:38 PM, Mike Tremaine wrote:
>
> The sonicwall service looks pretty old. Flow wise the first thing it 
> does is tries to split off the first 7 pieces
>
>
> ($month,$day,$time,$host_ip,$host_id,$host_sn,$msg)=split(/ 
> +/,$ThisLine,7);
>
> Then parse what is left. Most of them asume the line that is left 
> starts with n= and then src= so it;s
>
> Off by this
>> fw=198.15.66.58 pri=6 c=1024 m=97
>
> The service has a sample log line....
>
> #time="2005-03-23 09:03:27" fw=62.2.84.91 pri=5 c=128 m=37 msg="UDP 
> packet dropped" n=3759 src=64.74.133.26:11379:WAN 
> dst=62.2.84.91:33436:WAN^M
> #Mar 23 12:45:32 10.15.30.1 id=firewall sn=004010144097 
> time="2005-03-23 11:08:20" fw=62.2.84.91 pri=6 c=1024 m=98 n=61505 
> src=195.143.213.210:4992:WAN dst=62.2.84.92:1802:DMZ proto=tcp/1802 
> rcvd=106 ^M
>
> Which doesn't line up with yours... So I'd say there was some work to 
> be done.. :(
>
> -Mike
>
>
> On Jul 12, 2013, at 3:09 AM, Thomas Bernthaler wrote:
>
>> Hi,
>>
>> We have a new SonicWall and because I am a long-term user of logwatch 
>> I activated the SonicWall service. However it does not parse the info.
>>
>> The SonicWall logfile is about 800mb a day, I expected some summary 
>> but instead it seems like it packs in pretty much the whole 800mg 
>> into an email which of course never arrives.
>>
>> Therefore I think it must be a bug, maybe only at SonicWall 215tz 
>> since this is the only SonicWall we have so we can not test it 
>> against other versions of this firewall.
>>
>> Basically the reports has all lined of the logfile unparsed in the 
>> report. Looks like this:
>>
>> Jul 11 09:54:45 10.0.0.2 id=firewall sn=C0EAE41B3F84 time="2013-07-11 
>> 09:54:45" fw=198.15.66.58 pri=6 c=1024 m=97 n=574358 
>> src=50.140.113.63:49941:X1 dst=10.0.83.107:80:X0 proto=tcp/http 
>> op=GET sent=1363 rcvd=623 result=0 dstname=www.wf1broward.com 
>> arg=/upload/12216/websitebanner%20.jpg  code=64 Category="Not Rated"
>>
>> Jul 11 09:54:46 10.0.0.2 id=firewall sn=C0EAE41B3F84 time="2013-07-11 
>> 09:54:46" fw=198.15.66.58 pri=6 c=1024 m=97 n=574360 
>> src=108.206.254.173:49384:X1 dst=10.0.83.107:80:X0 proto=tcp/http 
>> op=GET sent=439 rcvd=324 result=0 dstname=www.wf1broward.com 
>> arg=/favicon.ico  code=64 Category="Not Rated"
>>
>> Jul 11 09:54:46 10.0.0.2 id=firewall sn=C0EAE41B3F84 time="2013-07-11 
>> 09:54:46" fw=198.15.66.58 pri=6 c=1024 m=97 n=574360 
>> src=66.249.73.234:39834:X1 dst=10.0.83.107:80:X0 proto=tcp/http 
>> op=GET sent=724 rcvd=4693 result=0 dstname=www.wf1broward.com 
>> arg=/Claims_and_Benefits_English/text/SocialNetworkingWorkshop4.htm?date=2013-06-28 
>> code=64 Category="Not Rated"
>>
>>
>> Is there anything I can do or any patch to be applied?
>>
>> Best wishes,
>> Thomas
>> -- 
>>
>> ------------------------------------------------------------------------------
>> See everything from the browser to the database with AppDynamics
>> Get end-to-end visibility with application monitoring from AppDynamics
>> Isolate bottlenecks and diagnose root cause in seconds.
>> Start your free trial of AppDynamics Pro today!
>> http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk_______________________________________________
>> Logwatch-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/logwatch-devel
>

------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent 
caught up. So what steps can you take to put your SQL databases under 
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel