On Tue, Mar 18, 2003 at 04:43:53PM -0600, Sid Keller wrote: > Is there an easy way to get pflog information into a database? I don't > need for pf to log directly to a database, I would just like to be able > to take data from the pflog file and load it into a database, > specifically a postgresql database. Any ideas or thoughts on how to do > this?
* You have to parse the binary logs (not too difficult) or tcpdump ascii output (easier) and fill your database. * In parsing you have to be _very_ careful, pf logs contain potentially malicious data which may try to exploit/disrupt your analysis tools, parsers. See recent vulnerabilities in tcpdump (DoS) ethereal and snort (code execution). * There are a couple of recent threads on www.deadly.org on pf logs read these for more information. Can
