What I discovered is that different kinds (or classes if you will) of rules cause different log fields to be created. For example, setting logging to accounting instead of just logging causes byte info to be generated. However, say you have a rule that only gets activated once a week. On that day you will have certain fields you don't have other days. VPNs generate a whole other set of fields but only when they are used and logged. The bottom line is that the fields in the log are dependant on what kind of data is logged. Luckily it is consistent thruout the log at the time it is exported.
I take my logs and load them into a database every morning. I use Oracle so had to build the database with every available field type (took me a few weeks) and then I wrote a shell script that uses sed to convert the field names into something usable by Oracle and it builds and SQL*Loader script to load the data. It's pretty crude but does the job. I packaged up the 4.1 version and phoneboy had it on his site. I had to update it for NG/AI but need to repackage it. Jim Edwards -----Original Message----- From: Not Available [mailto:[EMAIL PROTECTED] Sent: Friday, April 16, 2004 3:36 AM To: [EMAIL PROTECTED] Subject: [FW-1] Log fields format Hi all, I'm working on a database application to handle some log analysis, and I'm finding some problem defining a complete record format to build my DB. I've tried exporting some logs with fw logexport, but it will generate files containing only populate fields (eg if you don't use NAT, the exported logs won't contain xlated fields). I tried looking into SmartView Tracker, under query definitions, and noticed there are lots of fields, but they are shown with their descriptive name, not the field name. Moreover, I couldn't find reliable information on field formats (length, type, ...). Is there some official document about it? Has anyone ever sorted this out? Any help appreciated... NA ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
