« Previous Next »

Thread: Cisco Pix logs

Last post 06-06-2008 9:56 AM by steve schofield. 3 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (4 items)

Sort Posts:

  • 06-04-2008, 3:43 PM

    • altair4
    • Not Ranked
    • Joined on 06-04-2008, 7:33 PM
    • Posts 2

    Cisco Pix logs

     The goal here is to craft a query whereby an IP address is suppled, and the result returned is a list of all urls accessed.  The syslog file is a text file, tab-delimited, in the following format:


    2008-05-21 08:49:58    Local6.Notice    10.13.30.2    %PIX-5-304001: 10.17.90.10 Accessed URL 206.190.50.59:/serv?s=150550015&dm=&t=0.9166543242483984&t_e=1
    2008-05-21 08:49:59    Local6.Notice    10.13.30.2    %PIX-5-304001: 10.17.40.58 Accessed URL 65.175.87.137:/a/hBINA-xAdIUrHB7REIJBNCvLK.AdIUrHSd/spacer-1.gif
    2008-05-21 08:49:59    Local6.Info    10.13.30.2    %PIX-6-302014: Teardown TCP connection 122281117 for outside:65.175.87.137/80 to inside:10.17.40.58/2385 duration 0:00:01 bytes 804 TCP FINs
    2008-05-21 08:50:00    Local6.Info    10.13.30.2    %PIX-6-305011: Built dynamic TCP translation from inside:10.17.50.70/1614 to outside:216.185.22.100/47811
    2008-05-21 08:50:00    Local6.Info    10.13.30.2    %PIX-6-302013: Built outbound TCP connection 122281118 for outside:206.16.21.33/80 (206.16.21.33/80) to inside:10.17.50.70/1614 (216.185.22.100/47811)
    2008-05-21 08:50:00    Local6.Info    10.13.30.2    %PIX-6-305011: Built dynamic TCP translation from inside:10.17.50.70/1615 to outside:216.185.22.100/47812

     

    The query is something along the lines of :

     

    Logparser -i:tsv "Select * FROM file\path  WHERE Field4 Like  "inside:10.17.90.78" -iSeparator:tab -headerRow:off

    Field4 returns the "%" sign and everything to the right of it.  I guess what I need is to tokenize the string and search for IP's but I am not sure how to go about that.

     

    Any ideas greatly appreciated. 

  • 06-05-2008, 11:38 PM In reply to

    Re: Cisco Pix logs

    Have you tried.

    Logparser -i:tsv "Select * FROM file\path  WHERE Field4 Like  "%inside:10.17.90.78%" -iSeparator:tab -headerRow:off

    Adding your own % percent signs in the like statement?  You have a like, but no wildcards in your clause.

    Steve Schofield
    Windows Server MVP - IIS
    http://weblogs.asp.net/steveschofield


    http://www.IISLogs.com
    Log archival solution
    Install, Configure, Forget
  • 06-06-2008, 9:11 AM In reply to

    • altair4
    • Not Ranked
    • Joined on 06-04-2008, 7:33 PM
    • Posts 2

    Re: Cisco Pix logs

     Logparser -i:tsv "Select * FROM file\path  WHERE Field4 Like  '%inside:10.17.90.78%'" -iSeparator:tab -headerRow:off

     

    does the trick.  (Got to watch the single quotes).  Thanks. 

  • 06-06-2008, 9:56 AM In reply to

    Re: Cisco Pix logs

    Thanks for letting me know.  I added the single quotes but didn't mention it.  If I ever have to search pix firewall logs,  I have the syntax now. :)

    Steve Schofield
    Windows Server MVP - IIS
    http://weblogs.asp.net/steveschofield


    http://www.IISLogs.com
    Log archival solution
    Install, Configure, Forget
Page 1 of 1 (4 items)
Microsoft Communities