If you are using Unix, this script works for NG.
--------------------------- Script Start --------------------------------
#/bin/sh
#
# Switch Firewall Logs daily - One Minute before Execution
# created from swap_fw_Logs.sh and fwlog2txt.sh
# Version 1.02 2004-jan-22
#
# 2004-feb-02-10:00
# added function to remove old firewall switch log file prior to switch
#
# Set Script Environment Variables
FWDIR=/opt/CPfw1-54
SWITCH_NAME=/tmp/switch-firewall-log.log
CSVFW1=firewall_log.csv
MIN_MAIL_SIZE=0
# this value is variable
#MAX_MAIL_SIZE=4990000
MAX_MAIL_SIZE=49900000
CORRECT_MESSAGE=/tmp/correct_fw_log_message
ADMIN_USER="[EMAIL PROTECTED]"
#FWLOGADMIN_USER="[EMAIL PROTECTED]"
FWLOGADMIN_USER="nobody"
#
#
#
# Set Shell Functions
#
log()
{
echo ${1} | tee -a ${2}
}# # Set Firewall Environment as job run as cronjob # . /opt/CPshrd-54/tmp/.CPprofile.sh
#
# Start Execution Here
# 11:59 -> 12:00
# wait for hour to occur
sleep 60
#
# Set file names to Sun,Mon,Tue,Wed,Thu,Fri,Sat so logs overwrite weekly
#
DAY_NAME=`/usr/bin/date +%a`
CSV_DAY_NAME=`/usr/bin/date +%e%b%Y | /usr/bin/sed 's/ //g'`
LOG_TIME=`/usr/bin/date +%R | /usr/bin/sed 's/://g'`
SWITCH_LOG=${SWITCH_NAME}.${LOG_TIME}
DAILY_LOG=${DAY_NAME}.${LOG_TIME}
LOG_FILE=`/usr/bin/echo "firewall_log_day_${DAILY_LOG}"`
TXT_FILE=`/usr/bin/echo "/tmp/fw-1_log_${CSV_DAY_NAME}_${DAILY_LOG}.csv"`
#
# remove last weeks log of events
#
rm ${SWITCH_LOG}
#
# save current fw log as filename given and create new fw log
#
log "Remove old Firewall switch file ${FWDIR}/log/${LOG_FILE}.log*" ${SWITCH_LOG}
rm ${FWDIR}/log/${LOG_FILE}.log*
log "Checking files are gone .... " ${SWITCH_LOG}
ls -l ${FWDIR}/log/${LOG_FILE}.log* >> ${SWITCH_LOG}
log "Processing Firewall Log" ${SWITCH_LOG}
log "New Log File ${LOG_FILE}" ${SWITCH_LOG}
log "Executing ${FWDIR}/bin/fw logswitch ${LOG_FILE}" ${SWITCH_LOG}
${FWDIR}/bin/fw logswitch ${LOG_FILE} >> ${SWITCH_LOG} 2>&1
log "Log Switch Complete " ${SWITCH_LOG}
#
# extract fw log records as csv file
#
log "Converting Log file to ascii text" ${SWITCH_LOG}
log "Input FW-1 log = ${LOG_FILE}" ${SWITCH_LOG}
log "Output Ascii log = ${TXT_FILE}" ${SWITCH_LOG}
log "fw directory = ${FWDIR}" ${SWITCH_LOG}log "Exporting FW-1 log to Ascii text using ${FWDIR}/bin/fwm" ${SWITCH_LOG}
log "Executing ${FWDIR}/bin/fwm logexport -i ${FWDIR}/log/${LOG_FILE}.log -n -o
${TXT_FILE}"
${SWITCH_LOG}
${FWDIR}/bin/fwm logexport -i ${FWDIR}/log/${LOG_FILE}.log -n -o ${TXT_FILE} >> ${SWITCH_LOG}
2>&1#
# compress csv file
#
log "Compressing Ascii File" ${SWITCH_LOG}
log "compress ${TXT_FILE}" ${SWITCH_LOG}
compress ${TXT_FILE}#
# uuencode compressed csv file for emailling
#
log "Uuencoding to ${TXT_FILE}.Z.uu but using standard output file name" ${SWITCH_LOG}
log "uuencode ${TXT_FILE}.Z ${TXT_FILE}.Z > ${TXT_FILE}.Z.uu" ${SWITCH_LOG}
uuencode ${TXT_FILE}.Z ${CSVFW1}.Z > ${TXT_FILE}.Z.uu#
# get uuencoded compressed csv file size
#
log "Checking Log Size against Mail Max Size" ${SWITCH_LOG}
log "ls -l ${TXT_FILE}.Z.uu | awk '{ print $5 }'" ${SWITCH_LOG}
LOG_SIZE=`ls -l ${TXT_FILE}.Z.uu | awk '{ print $5 }'`#
# check uuencoded compressed csv file size
#
if [ ${LOG_SIZE} -eq ${MIN_MAIL_SIZE} ] ; then
#
# file empty!!
#
log "No log ${TXT_FILE}.Z to Email" ${SWITCH_LOG}
log "/dev/null | mailx -s ERROR Firewall log = 0 ${FWLOGADMIN_USER}" ${SWITCH_LOG}
cat /dev/null | mailx -s "ERROR Firewall log = 0" ${FWLOGADMIN_USER}
else
#
# file not empty!!
#
if [ ${LOG_SIZE} -lt ${MAX_MAIL_SIZE} ] ; then
#
# file less than max size
#
echo "Emailing log ${TXT_FILE}.Z"
log "cat ${TXT_FILE}.Z.uu | mailx -s Firewall Log ${TXT_FILE}.Z ${ADMIN_USER}"
${SWITCH_LOG}
cat ${TXT_FILE}.Z.uu | mailx -s "Firewall Log ${TXT_FILE}.Z" ${ADMIN_USER}
log "cat /dev/null | mailx -s Firewall Log ${TXT_FILE}.Z = ${LOG_SIZE}
${FWLOGADMIN_USER}"
${SWITCH_LOG}
cat /dev/null | mailx -s "Firewall Log ${TXT_FILE}.Z = ${LOG_SIZE}"
${FWLOGADMIN_USER}
else
#
# file larger than max size
#
log "Emailing log ${TXT_FILE}.Z will Fail - LOG TOO LARGE" ${SWITCH_LOG}
log "cat /dev/null | mailx -s Firewall Log ${TXT_FILE}.Z - TOO LARGE FOR EMAIL
${FWLOGADMIN_USER}" ${SWITCH_LOG}
cat /dev/null | mailx -s "Firewall Log ${TXT_FILE}.Z - TOO LARGE FOR EMAIL "
${FWLOGADMIN_USER}
fi
fi
#
# tidy up large temporary files
#
log "Removing temporary files" ${SWITCH_LOG}
rm ${TXT_FILE}.Z ${TXT_FILE}.Z.uu--------------------------- Script Start --------------------------------
Nick Brandson wrote:
hi guru,
have noticed that the auto logswitch function does not work suddenly? It has been up and running for a period of time. It stoped once i have created a sec mgt/log server. Manual logswitch with CLI and SmartView Tracker is working fine.
Any ideas? rdgs Nick
__________________________________ Do you Yahoo!? Get better spam protection with Yahoo! Mail. http://antispam.yahoo.com/tools
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
-- Regards
Russell
Email: russell dot aspinwall at flomerics dot co dot uk
Network and Systems Administrator Flomerics Ltd
Telephone: 020-8941-8810 x3116 81 Bridge Road
Facsimile: 020-8941-8730 Hampton Court
Surrey, KT8 9HH
United Kingdom================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
