On Tue, Feb 28, 2012 at 3:27 PM, C. L. Martinez <[email protected]> wrote:
> Hi all,
>
>  I am wrong, or do not exists rules and decoder to process CheckPoint
> Firewall-1 logs??
>
> Thanks.

Oops ... Sorry, my mistake. I see it. But I need to parse CHKP logs
from an export log and not from syslog ... If I am not wrong, I need
to write a new decoder and after that some rules.

 I am trying to write this decoder, without luck. My sample log:

"Number" "Date" "Time" "Interface" "Origin" "Type" "Action" "Service"
"Source Port" "Source" "Destination" "Protocol" "Rule" "Rule Name"
"Current Rule Number" "User" "Information" "Product" "Source Machine
Name" "Source User Name"
 "2" "26Feb2012" "23:58:58" "Lan2" "CHCKPNT1" "Log" "Accept" "https"
"1638" "192.168.55.23" "10.45.23.11" "tcp" "52" "WK01" "52-Standard"
"" "service_id: https" "VPN-1 Power/UTM" "" ""

My first try:

<decoder name="custom-checkpoint">
  <program_name>^CHCKPNT1</program_name>
  <prematch>^\s+ "\d\d\Ddd\dddd"  "\d\d:\d\d:\d\d" </prematch>
</decoder>

Any idea??

Reply via email to