RE: Checkpoint Firewall rulebase - logs
"Jeff Dell" <[email protected]>
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <045001c7d91c$48d15ae0$da7410a0$@com> |
-p disables port resolution.. Cheers, Jeff -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of James Sent: Monday, August 06, 2007 7:40 PM To: Mordechai T. Abzug Cc: [email protected] Subject: Re: [logs] Checkpoint Firewall rulebase - logs On 8/6/07, Mordechai T. Abzug <[email protected]> wrote: > > Another issue with exporting logs via the logger method is that you > > cannot disable service name resolution (or at least I have lost the > > switch how to disable it). > > IIRC, you can do this with -n. Google confirms [curiously, a post by > tbird]: > > http://www.splunk.com/base/Checkpoint/30987 Unfortunately not (at least on NGX). -n disables hostname resolution but not service name resolution <sigh>. A trick I have mentioned to tbird is to name your services <protocol>_<port_number> eg tcp_80 but sometimes you will get stomped on by checkpoints default services. LEA looks like the way to go and when I get around to it I will put an rfi into checkpoint to add a switch to fw log to disable service name reolution so that the logs will actually be useful (in a multi vendor or SIM SEM environment). Unless someone allready knows a way ... -- jac _______________________________________________ LogAnalysis mailing list [email protected] http://www.loganalysis.org/mailman/listinfo/loganalysis