Logging is not very documented. For my early test, i found and issue. Create a file called logexport_default.C and put required field for export (in $FWDIR/conf) You can find the file in attachment.
Sorry for bad english. Regard's
Aurelien.
Not Available wrote:
Hi all,
I'm working on a database application to handle some log analysis, and I'm finding some problem defining a complete record format to build my DB.
I've tried exporting some logs with fw logexport, but it will generate files containing only populate fields (eg if you don't use NAT, the exported logs won't contain xlated fields).
I tried looking into SmartView Tracker, under query definitions, and noticed there are lots of fields, but they are shown with their descriptive name, not the field name.
Moreover, I couldn't find reliable information on field formats (length, type, ...).
Is there some official document about it? Has anyone ever sorted this out?
Any help appreciated...
NA
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
(
:log-props (
:fields (
# : (num)
: (date)
: (time)
: (orig)
: (type)
: (action)
: (alert)
: (i/f_name)
: (i/f_dir)
: (product)
: (src)
: (dst)
: (s_port)
: (service)
: (proto)
: (xlatesrc)
: (xlatedst)
: (xlatesport)
: (xlatedport)
: (rule)
: (nat_rulenum)
: (nat_addtnl_rulenum)
: (user)
: (partner)
: (community)
: (session_id)
#
# *** IPv6 fields ***
: (ipv6_src)
: (ipv6_dst)
#
# *** VPN-1 fields ***
: (srckeyid)
: (dstkeyid)
: ("scheme:")
: ("methods:")
: (CookieI)
: (CookieR)
: (msgid)
: ("peer gateway")
#
# *** Account fields ***
: (elapsed)
: (bytes)
: (packets)
: (start_time)
#
# *** FloodGate-1 fields ***
: (client_inbound_interface)
: (client_outbound_interface)
: (server_inbound_interface)
: (server_outbound_interface)
: (client_inbound_bytes)
: (client_outbound_bytes)
: (server_inbound_bytes)
: (server_outbound_bytes)
: (client_inbound_packets)
: (client_outbound_packets)
: (server_inbound_packets)
: (server_outbound_packets)
: (client_inbound_diffserv)
: (client_outbound_diffserv)
: (server_inbound_diffserv)
: (server_outbound_diffserv)
: ("fg-1_client_in_rule_name")
: ("fg-1_client_out_rule_name")
: ("fg-1_server_in_rule_name")
: ("fg-1_server_out_rule_name")
: ("fg-1_sub_service")
#
# *** VoIP fields ***
: ("src phone number")
: ("dst phone number")
: ("media type")
: ("Registered IP-phones")
#
# *** UA (User Authority) fields ***
: (snid)
: (ua_snid)
: (d_name)
: (id_src)
: (ua_operation)
: (sso_type_desc)
: (app_name)
: (auth_domain)
: (uname4domain)
: (wa_headers)
: (result_desc)
: (r_dest)
: (comment)
: (url)
: (redirect_url)
: (enc_desc)
: (e2e_enc_desc)
: (auth_result)
#
# *** RTM (Virtual Link Monitoring) fields ***
: (sample_id)
: (estimation)
: (wire_byte_ps_out)
: (wire_byte_ps_in)
: (wire_pack_ps_out)
: (wire_pack_ps_in)
: (app_byte_ps_out)
: (app_byte_ps_in)
: (app_pack_ps_out)
: (app_pack_ps_in)
: (src_gw)
: (dst_gw)
: (rtt)
: (rtt_threshold)
: (bw_loss)
: (bw_loss_threshold)
: (cir)
: (cir_threshold)
: (sla_violation)
: (vl)
: (status)
#
# *** FW-1 GX fields ***
: (tid)
: (ms_isdn)
: (signal_type)
: (apn)
: (end_user_address)
: (sgsn_signal)
: (sgsn_traffic)
: (ggsn_signal)
: (ggsn_traffic)
: (selection_mode)
: (gtp_ver)
: (nsapi)
: (linked_nsapi)
: (teid_uplink)
: (teid_dnlink)
: (mobile_country_code)
: (mobile_network_code)
: (mobile_subscriber_code)
#
# *** ASM (SmartDefence) fields ***
: (attack)
)
)
)================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
