#!/usr/bin/perl ##### # This perl script reconverts PIX syslogs back to PIX format from Syslog-ng format. # We could have done this with Syslog-ng filters but this is only used for reporting purposes. # so it's just a preprocessor to convert the stored format # # Released as freeware. # No warranties or support, your mileage may vary, etc... # # Wynn Fenwick (wfenwick at FHLSim.com) ##### my @sfmon = qw (Nul Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec); while (<>) { ($left, $right) = split /\%/; # save the PIX stuff since it's all good # 2004-04-20 10:50:17 host/ip local4.warning ($year,$mon,$day,$hour,$min,$sec,$IP,$facility,$severity) = $_ =~ m/^(\d+)-(\d+)-(\d+) (\d*)\:(\d*)\:(\d*) (\S+) (\S+).(\S+)/s; $newleft = sprintf("%s %02d %02d:%02d:%02d %s %s %02d %04d %02d:%02d:%02d:", $sfmon[$mon], $day, $hour, $min, $sec, $IP, $sfmon[$mon], $day, $year, $hour, $min, $sec); print $newleft, " \%", $right; } exit(0); ##### # Original sample PIX log entries: ##### # Oct 28 13:45:57 router Oct 28 1999 13:47:30: %PIX-6-302001: Built inbound TCP connection 512495 for faddr 128.151.81.205/1057 gadd r 128.151.215.5/23 laddr 128.151.215.5/23 # Oct 28 13:46:04 router Oct 28 1999 13:47:38: %PIX-6-302001: Built outbound TCP connection 512508 for faddr 128.151.225.95/113 gadd r 128.151.223.3/45966 laddr 128.151.223.3/45966 # Oct 28 13:46:04 router Oct 28 1999 13:47:38: %PIX-6-302005: Built UDP connection for faddr 128.151.7.6/1 gaddr 128.151.223.3/34847 laddr 128.151.223.3/34847 # Feb 28 12:11:59 router Feb 28 2000 12:15:26: %PIX-2-106001: Inbound TCP connection denied from 209.138.199.165/2048 to 128.151.215 .5/23 flags SYN # Mar 2 13:08:20 router Mar 02 2000 13:11:51: %PIX-2-106012: Deny IP from 63.84.162.97 to 128.151.223.3, IP options 0x803c11c4 ##### # After munging by syslog-ng ##### #2004-04-20 10:50:17 192.168.253.3 local4.warning %PIX-4-106023: Deny udp src inside:172.16.100.62/1138 dst outside:192.5.5.241/53 by access-group "inside-acl" #2004-04-20 10:50:17 192.168.253.3 local4.warning %PIX-4-106023: Deny udp src inside:172.16.100.62/1138 dst outside:192.5.5.241/53 by access-group "inside-acl" #2004-04-20 10:50:17 192.168.253.3 local4.warning %PIX-4-106023: Deny tcp src inside:172.16.109.176/1042 dst outside:64.4.50.99/25 by access-group "inside-acl"