Dpp, thanks for the input, would you be able to show me your corresponding rules as our decoders seem identical apart from where we chomp the spaces!
Cheers, Dan. On 30 Sep, 14:24, ddp <[email protected]> wrote: > The following decoders seem to work for me. The regex is a little > dirty, but it appears to work. I guess I have a checkpoint-syslog-fw, > so I had to change the decoder's name and update it in the rules too. > > <decoder name="checkpoint-syslog"> > <prematch>^Checkpoint \d\d:\d\d:\d\d</prematch> > </decoder> > > <decoder name="checkpoint-syslog-fw2"> > <parent>checkpoint-syslog</parent> > <use_own_name>true</use_own_name> > <prematch offset="after_parent">^\s+drop|^\s+accept|^\s+reject</prematch> > <regex offset="after_parent">^\s+(\S+)\s+\.+src: (\d+.\d+.\d+.\d+); > dst: (\d+.\d+.\d+.\d+); proto: (\S+);</regex> > <order>action,srcip,dstip,protocol</order> > </decoder> > > <decoder name="checkpoint-syslog-vpn"> > <parent>checkpoint-syslog</parent> > <use_own_name>true</use_own_name> > <prematch offset="after_parent">^\s+encrypt|^\s+decrypt</prematch> > <regex offset="after_parent">^\s+(\S+)\s+\.+src: (\d+.\d+.\d+.\d+); > dst: (\d+.\d+.\d+.\d+); proto: (\S+);</regex> > <order>action,srcip,dstip,protocol</order> > </decoder>
