Is there an official UTM logfile schema description?

Question

Hello community, 
 I am looking for a log file description for SG (and XG) firewalls. A lot of logs do have an id="xxxs" field, for example: 
 <30>2021:03:11-22:26:42 gateway ulogd[7988]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="24" initf="eth1" outitf="tun0" srcmac="de:22:b1:44:81:ef" dstmac="ee:3b:61:f4:3f:41" srcip="192.168.22.97" dstip="10.238.2.4" proto="1" length="84" tos="0x00" prec="0x00" ttl="62" type="8" code="0" 
 Can anybody refer me to a KB or document that describes the log files, especially the meaning of the "id" field. 
 Regards, 
 Daniel

DouglasFoster · Accepted Answer

I have written tools to parse each of the useful log files into a SQL database. (Splunk would probably have been a much better starting point, but it was not an available option.) When doing so, I wrote pretty extensively on what I was learning and how I did it. Most of those items are somewhere in "Recommended Reads" 
 As part of that effort, I built a master list of Item IDs. In most cases, Item ID also determines the "name", "Sys", and "Sub" parameters, so these are included. The final column indicates the log file where the Item ID can appear. You should be able to drop this list into a CSV text file, then import it into Excel for better readability. 
 There will be omissions associated with the functions that I have never used, but at least you have a starting point. 
 ItmId,Itmname,ItmSys,ItmSub,LogFile 0001,http access,SecureWeb,http,http 0002,web request blocked,SecureWeb,http,http 0003,http access.,SecureWeb,http,http 0056,"web request blocked, virus detected",SecureWeb,http,http 0057,"web request blocked, PUA detected",SecureWeb,http,http 0059,"web request blocked, forbidden tag detected",SecureWeb,http,http 0060,"web request blocked, forbidden category detected",SecureWeb,http,http 0061,"web request blocked, reputation limit",SecureWeb,http,http 0062,"web request blocked, forbidden url detected",SecureWeb,http,http 0063,Contentfilter override, , , 0064,"web request blocked, forbidden file extension detected",SecureWeb,http,http 0065,"web request blocked, forbidden mimetype detected",SecureWeb,http,http 0066,"web request blocked, forbidden application detected",SecureWeb,http,http 0067,"web request blocked, connection to forbidden country",SecureWeb,http,http 0068,"web request blocked, threat detected",SecureWeb,http,http 0070,"web request blocked, download exceeds maximum allowable size",SecureWeb,http,http 0071,"web request warned, forbidden category detected",SecureWeb,http,http 0072,Contentfilter warned and proceeded,SecureWeb,http,http 0073,"web request warned, forbidden file extension detected",SecureWeb,http,http 0074,File extension warned and proceeded,SecureWeb,http,http 0079,"web request quota-limited, forbidden category detected",SecureWeb,http,http 0080,Contentfilter quota-limited and proceeded,SecureWeb,http,http 0299,reverseproxy,,,reverseproxy 1000,email passed,SecureMail,smtp,smtp 1001,email quarantined,SecureMail,smtp,smtp 1100,email passed,SecureMail,pop3,pop3 1101,email quarantined,SecureMail,pop3,pop3 2001,Packet dropped,SecureNet,packetfilter,packetfilter 2002,Packet accepted,SecureNet,packetfilter,packetfilter 2003,Packet rejected, ,packetfilter,packetfilter 2009,ICMP redirect,SecureNet,packetfilter,packetfilter 2013,FTP data,SecureNet,packetfilter,packetfilter 2017,AFC Alert,SecureNet,packetfilter,afc 2019,AFC Block,SecureNet,packetfilter,afc 2021,Packet dropped (GEOIP),SecureNet,packetfilter,aptp 2022,Packet dropped (ATP),SecureNet,packetfilter,aptp 2101,Intrusion protection alert,SecureNet,ips,ips 2104,ICMP flood detected,SecureNet,ips,ips 2201,Connection started,SecureNet,vpn,html5vpn 2202,Connection stopped,SecureNet,vpn,html5vpn 3004,Login Success,System,auth,aua 3005,Login Processing,System,auth,aua 3006,Login Failure,System,auth,aua 3100,timeout: removing session,System,confd,confd 310a,object changed,System,confd,confd 310c,node changed,System,confd,confd 310n,applied changes,System,confd,confd 3701,Authentication successful,system,up2date,up2date 3707,Successfully synchronized fileset,system,up2date,up2date

FormerMember · Answer

Hi dtconnect , 
 Thank you for reaching out to Sophos Community. 
 "id=" in log event indicated message ID for specific log component. 
 Refer to the article below for more information on "Firewall Log Format". 
 support.sophos.com/.../KB-000037366

Is there an official UTM logfile schema description?

Top Replies