#!/usr/bin/perl
#####
# This perl script reconverts PIX syslogs back to PIX format from Syslog-ng format.
# We could have done this with Syslog-ng filters but this is only used for reporting purposes.
# so it's just a preprocessor to convert the stored format
#
# Released as freeware.
# No warranties or support, your mileage may vary, etc...
#
# Wynn Fenwick (wfenwick at FHLSim.com)
#####

my @sfmon = qw (Nul Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec);

while (<>) {

   ($left, $right) = split /\%/; # save the PIX stuff since it's all good


   #                                                                    2004-04-20        10:50:17            host/ip local4.warning
   ($year,$mon,$day,$hour,$min,$sec,$IP,$facility,$severity) = $_ =~ m/^(\d+)-(\d+)-(\d+) (\d*)\:(\d*)\:(\d*) (\S+) (\S+).(\S+)/s;
   $newleft = sprintf("%s %02d %02d:%02d:%02d %s %s %02d %04d %02d:%02d:%02d:", 
                      $sfmon[$mon], $day, $hour, $min, $sec, $IP, $sfmon[$mon], $day, $year,  $hour, $min, $sec);

   print  $newleft, " \%", $right;
}
exit(0);


#####
# Original sample PIX log entries:
#####
# Oct 28 13:45:57 router Oct 28 1999 13:47:30: %PIX-6-302001: Built inbound TCP connection 512495 for faddr 128.151.81.205/1057 gadd r 128.151.215.5/23 laddr 128.151.215.5/23
# Oct 28 13:46:04 router Oct 28 1999 13:47:38: %PIX-6-302001: Built outbound TCP connection 512508 for faddr 128.151.225.95/113 gadd r 128.151.223.3/45966 laddr 128.151.223.3/45966
# Oct 28 13:46:04 router Oct 28 1999 13:47:38: %PIX-6-302005: Built UDP connection for faddr 128.151.7.6/1 gaddr 128.151.223.3/34847 laddr 128.151.223.3/34847
# Feb 28 12:11:59 router Feb 28 2000 12:15:26: %PIX-2-106001: Inbound TCP connection denied from 209.138.199.165/2048 to 128.151.215 .5/23 flags SYN
# Mar  2 13:08:20 router Mar 02 2000 13:11:51: %PIX-2-106012: Deny IP from 63.84.162.97 to 128.151.223.3, IP options 0x803c11c4

#####
# After munging by syslog-ng
#####
#2004-04-20 10:50:17 192.168.253.3 local4.warning	%PIX-4-106023: Deny udp src inside:172.16.100.62/1138 dst outside:192.5.5.241/53 by access-group "inside-acl"
#2004-04-20 10:50:17 192.168.253.3 local4.warning	%PIX-4-106023: Deny udp src inside:172.16.100.62/1138 dst outside:192.5.5.241/53 by access-group "inside-acl"
#2004-04-20 10:50:17 192.168.253.3 local4.warning	%PIX-4-106023: Deny tcp src inside:172.16.109.176/1042 dst outside:64.4.50.99/25 by access-group "inside-acl"

