fwm logexport

Description fwm logexport exports the Log file to an ASCII file.

Syntax > fwm logexport [-d <delimiter>] [-i <filename>] [-o <outputfile>] [-n] [-p]
[-f] [-m {initial|semi|raw}] [-a]

Parameter	Description
`-d <delimiter>`	Set the output delimiter. The default is a semicolon (`;`).
`-i <filename>`	The name of the input Log file. The default is the active Log file, `fw.log`
`-o <outputfile>`	The name of the output file. The default is printing to the screen.
`-n`	Do not perform DNS resolution of the IP addresses in the Log file (this option significantly speeds the processing).
`-p`	Do not perform service resolution. A service port number is displayed.
`-f`	If this is the active Log file (`fw.log`), wait for new records and export them to the ASCII output file as they occur.
`-m {initial\|semi\|raw}`	This flag specifies the unification mode. `initial` - the default mode. Complete the unification of log records; that is, output one unified record for each id. `semi` - step-by-step unification, that is, for each log record, output a record that unifies this record with all previously-encountered records with the same id. `raw` - output all records, with no unification.
`-a`	Show account records only (the default is to show all records).

Comments Controlling the Output of fwm logexport using logexport.ini

The output of fwm logexport can be controlled by creating a file called logexport.ini and placing it in the conf directory: $FWDIR/conf. The logexport.ini file should be in the following format:

[Fields_Info]

included_fields = field1,field2,field3,<REST_OF_FIELDS>,field100

excluded_fields = field10,field11

note that:

the num field will always appear first, and cannot be manipulated using logexport.ini
<REST_OF_FIELDS> is a reserved token that refers to a list of fields. It is optional. If -f option is set, <REST_OF_FIELDS> is based on a list of fields taken from the file logexport_default.C.
If -f is not set, <REST_OF_FIELDS> will be based on the given input log file.
It is not mandatory to specify both included_fields and excluded_fields.

Format:

The fwm logexport output appears in tabular format. The first row lists the names of all fields included in the subsequent records. Each of the subsequent rows consists of a single log record, whose fields are sorted in the same order as the first row. If a record has no information on a specific field, this field remains empty (as indicated by two successive semi-colons).

Example

num;date;time;orig;type;action;alert;i/f_name;i/f_dir;product;sys_message:;service;s_port;src;dst;

0; 5Dec2002;9:08:44;jam.checkpoint.com;control; ;;daemon;inbound;VPN-1 & FireWall-1;The hme0 interface
is not protected by the anti-spoofing feature. Your network may be at risk;;;;;

1; 5Dec2002;9:08:44;jam.checkpoint.com;control; ;;daemon;inbound;VPN-1 & FireWall-1;;
ftp;23456;1.2.3.4;3.4.5.6;