Re: [fwAnalog] fwanalog on Watchguard FireBox

From: Balázs Bárány (balazs~AT~tud.at)
Date: Thu Feb 24 2005 - 14:57:09 CET

• Next message: Balázs Bárány: "Re: [fwAnalog] PIX Level 5 (outbound) logs"
• Previous message: Zakai Kinan: "Re: [fwAnalog] fwanalog doesn't find messages"
• In reply to: stracey~AT~tpsx.com: "[fwAnalog] fwanalog on Watchguard FireBox"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Hello,

• stracey~AT~tpsx.com <stracey~AT~tpsx.com> [2004-09-24 21:57]:
  > I did notice that the export files contain an extra line in the
  > beginning that says " DO_NOT_EDIT_THIS_FILE!_version_2.00 728".
  > Would this impact the scripts?
  no, fwanalog normally greps for lines that look like firewall log lines.

> Also, I've included a sample of a few lines. The watchguard verion is
That's not really enough, also, I need to know what a line means (e.g. you have "allow" _and_ "Filtered-SMTP" in a line, is that default or your configuration, was that packet blocked or not, etc. Also, when anonymizing logs, please change the numbers to 10.10.10 or something like this, so I don't have to do it for tests myself.

Regards

-- 
_________________________________________________________________
Balázs Bárány     balazs~AT~tud.at     http://tud.at    ICQ 10747763

Computers. You can't live with them, you can't live without them.

• Next message: Balázs Bárány: "Re: [fwAnalog] PIX Level 5 (outbound) logs"
• Previous message: Zakai Kinan: "Re: [fwAnalog] fwanalog doesn't find messages"
• In reply to: stracey~AT~tpsx.com: "[fwAnalog] fwanalog on Watchguard FireBox"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.5 : Thu Feb 24 2005 - 15:02:04 CET