Re: "session" messages in Cisco FWSM logs?

Hi Andrew,
    This looks like EMBLEM format. I have seen this kind of id (event class before facility ) when I enabled EMBLEM format on cisco ASA box. Should not be any different for FWSM.

Anusuya

Sent from my iPhone

On Mar 14, 2008, at 6:46 AM, "Andrew Hay" <[email protected]> wrote:

Hey All,

I've been struggling to find some sort of documentation on the Cisco site (or elsewhere) that tell me why, all of a sudden, Cisco FWSM logs now have the string "session" where there was no "session" string before :)

Example:

%FWSM-session-6-305011

For as far back as I can remember the format has always been %FWSM-<facility>-<unique cisco id> (e.g. %FWSM-6-305011). Does anyone know why/when this has changed and if there is any associated documentation referencing it....anywhere?

-- 
Andrew Hay
blog: http://www.andrewhay.ca
email: andrewsmhay || at || gmail.com
LinkedIn Profile: http://www.linkedin.com/in/andrewhay
OSSEC Book: http://preview.tinyurl.com/2oy63f
_______________________________________________
LogAnalysis mailing list
[email protected]
http://www.loganalysis.org/mailman/listinfo/loganalysis



      ____________________________________________________________________________________
Never miss a thing.  Make Yahoo your home page. 
http://www.yahoo.com/r/hs

_______________________________________________
LogAnalysis mailing list
[email protected]
http://www.loganalysis.org/mailman/listinfo/loganalysis