I don't think I modified the rules, except to change the decoder name from checkpoint-syslog-fw to checkpoint-syslog-fw2.
On Thu, Oct 1, 2009 at 7:55 AM, dthfoo <[email protected]> wrote: > > Dpp, > > thanks for the input, would you be able to show me your corresponding > rules as our decoders seem identical apart from where we chomp the > spaces! > > Cheers, > > Dan. > > On 30 Sep, 14:24, ddp <[email protected]> wrote: >> The following decoders seem to work for me. The regex is a little >> dirty, but it appears to work. I guess I have a checkpoint-syslog-fw, >> so I had to change the decoder's name and update it in the rules too. >> >> <decoder name="checkpoint-syslog"> >> <prematch>^Checkpoint \d\d:\d\d:\d\d</prematch> >> </decoder> >> >> <decoder name="checkpoint-syslog-fw2"> >> <parent>checkpoint-syslog</parent> >> <use_own_name>true</use_own_name> >> <prematch offset="after_parent">^\s+drop|^\s+accept|^\s+reject</prematch> >> <regex offset="after_parent">^\s+(\S+)\s+\.+src: (\d+.\d+.\d+.\d+); >> dst: (\d+.\d+.\d+.\d+); proto: (\S+);</regex> >> <order>action,srcip,dstip,protocol</order> >> </decoder> >> >> <decoder name="checkpoint-syslog-vpn"> >> <parent>checkpoint-syslog</parent> >> <use_own_name>true</use_own_name> >> <prematch offset="after_parent">^\s+encrypt|^\s+decrypt</prematch> >> <regex offset="after_parent">^\s+(\S+)\s+\.+src: (\d+.\d+.\d+.\d+); >> dst: (\d+.\d+.\d+.\d+); proto: (\S+);</regex> >> <order>action,srcip,dstip,protocol</order> >> </decoder> >
