Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 5 subscribers
  • Views 2487 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is there an official UTM logfile schema description?

dtconnect

Hello community,

I am looking for a log file description for SG (and XG) firewalls. A lot of logs do have an id="xxxs" field, for example:

<30>2021:03:11-22:26:42 gateway ulogd[7988]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="24" initf="eth1" outitf="tun0" srcmac="de:22:b1:44:81:ef" dstmac="ee:3b:61:f4:3f:41" srcip="192.168.22.97" dstip="10.238.2.4" proto="1" length="84" tos="0x00" prec="0x00" ttl="62" type="8" code="0"

Can anybody refer me to a KB or document that describes the log files, especially the meaning of the "id" field.

Regards,

Daniel

 



This thread was automatically locked due to age.
Parents
  • +1

    I have written tools to parse each of the useful log files into a SQL database.  (Splunk would probably have been a much better starting point, but it was not an available option.)  When doing so, I wrote pretty extensively on what I was learning and how I did it.   Most of those items are somewhere in "Recommended Reads"

    As part of that effort, I built a master list of Item IDs.   In most cases, Item ID also determines the "name", "Sys", and "Sub" parameters, so these are included.   The final column indicates the log file where the Item ID can appear.   You should be able to drop this list into a CSV text file, then import it into Excel for better readability.

    There will be omissions associated with the functions that I have never used, but at least you have a starting point. 

    ItmId,Itmname,ItmSys,ItmSub,LogFile
    0001,http access,SecureWeb,http,http
    0002,web request blocked,SecureWeb,http,http
    0003,http access.,SecureWeb,http,http
    0056,"web request blocked, virus detected",SecureWeb,http,http
    0057,"web request blocked, PUA detected",SecureWeb,http,http
    0059,"web request blocked, forbidden tag detected",SecureWeb,http,http
    0060,"web request blocked, forbidden category detected",SecureWeb,http,http
    0061,"web request blocked, reputation limit",SecureWeb,http,http
    0062,"web request blocked, forbidden url detected",SecureWeb,http,http
    0063,Contentfilter override, , ,
    0064,"web request blocked, forbidden file extension detected",SecureWeb,http,http
    0065,"web request blocked, forbidden mimetype detected",SecureWeb,http,http
    0066,"web request blocked, forbidden application detected",SecureWeb,http,http
    0067,"web request blocked, connection to forbidden country",SecureWeb,http,http
    0068,"web request blocked, threat detected",SecureWeb,http,http
    0070,"web request blocked, download exceeds maximum allowable size",SecureWeb,http,http
    0071,"web request warned, forbidden category detected",SecureWeb,http,http
    0072,Contentfilter warned and proceeded,SecureWeb,http,http
    0073,"web request warned, forbidden file extension detected",SecureWeb,http,http
    0074,File extension warned and proceeded,SecureWeb,http,http
    0079,"web request quota-limited, forbidden category detected",SecureWeb,http,http
    0080,Contentfilter quota-limited and proceeded,SecureWeb,http,http
    0299,reverseproxy,,,reverseproxy
    1000,email passed,SecureMail,smtp,smtp
    1001,email quarantined,SecureMail,smtp,smtp
    1100,email passed,SecureMail,pop3,pop3
    1101,email quarantined,SecureMail,pop3,pop3
    2001,Packet dropped,SecureNet,packetfilter,packetfilter
    2002,Packet accepted,SecureNet,packetfilter,packetfilter
    2003,Packet rejected, ,packetfilter,packetfilter
    2009,ICMP redirect,SecureNet,packetfilter,packetfilter
    2013,FTP data,SecureNet,packetfilter,packetfilter
    2017,AFC Alert,SecureNet,packetfilter,afc
    2019,AFC Block,SecureNet,packetfilter,afc
    2021,Packet dropped (GEOIP),SecureNet,packetfilter,aptp
    2022,Packet dropped (ATP),SecureNet,packetfilter,aptp
    2101,Intrusion protection alert,SecureNet,ips,ips
    2104,ICMP flood detected,SecureNet,ips,ips
    2201,Connection started,SecureNet,vpn,html5vpn
    2202,Connection stopped,SecureNet,vpn,html5vpn
    3004,Login Success,System,auth,aua
    3005,Login Processing,System,auth,aua
    3006,Login Failure,System,auth,aua
    3100,timeout: removing session,System,confd,confd
    310a,object changed,System,confd,confd
    310c,node changed,System,confd,confd
    310n,applied changes,System,confd,confd
    3701,Authentication successful,system,up2date,up2date
    3707,Successfully synchronized fileset,system,up2date,up2date

Reply
  • +1

    I have written tools to parse each of the useful log files into a SQL database.  (Splunk would probably have been a much better starting point, but it was not an available option.)  When doing so, I wrote pretty extensively on what I was learning and how I did it.   Most of those items are somewhere in "Recommended Reads"

    As part of that effort, I built a master list of Item IDs.   In most cases, Item ID also determines the "name", "Sys", and "Sub" parameters, so these are included.   The final column indicates the log file where the Item ID can appear.   You should be able to drop this list into a CSV text file, then import it into Excel for better readability.

    There will be omissions associated with the functions that I have never used, but at least you have a starting point. 

    ItmId,Itmname,ItmSys,ItmSub,LogFile
    0001,http access,SecureWeb,http,http
    0002,web request blocked,SecureWeb,http,http
    0003,http access.,SecureWeb,http,http
    0056,"web request blocked, virus detected",SecureWeb,http,http
    0057,"web request blocked, PUA detected",SecureWeb,http,http
    0059,"web request blocked, forbidden tag detected",SecureWeb,http,http
    0060,"web request blocked, forbidden category detected",SecureWeb,http,http
    0061,"web request blocked, reputation limit",SecureWeb,http,http
    0062,"web request blocked, forbidden url detected",SecureWeb,http,http
    0063,Contentfilter override, , ,
    0064,"web request blocked, forbidden file extension detected",SecureWeb,http,http
    0065,"web request blocked, forbidden mimetype detected",SecureWeb,http,http
    0066,"web request blocked, forbidden application detected",SecureWeb,http,http
    0067,"web request blocked, connection to forbidden country",SecureWeb,http,http
    0068,"web request blocked, threat detected",SecureWeb,http,http
    0070,"web request blocked, download exceeds maximum allowable size",SecureWeb,http,http
    0071,"web request warned, forbidden category detected",SecureWeb,http,http
    0072,Contentfilter warned and proceeded,SecureWeb,http,http
    0073,"web request warned, forbidden file extension detected",SecureWeb,http,http
    0074,File extension warned and proceeded,SecureWeb,http,http
    0079,"web request quota-limited, forbidden category detected",SecureWeb,http,http
    0080,Contentfilter quota-limited and proceeded,SecureWeb,http,http
    0299,reverseproxy,,,reverseproxy
    1000,email passed,SecureMail,smtp,smtp
    1001,email quarantined,SecureMail,smtp,smtp
    1100,email passed,SecureMail,pop3,pop3
    1101,email quarantined,SecureMail,pop3,pop3
    2001,Packet dropped,SecureNet,packetfilter,packetfilter
    2002,Packet accepted,SecureNet,packetfilter,packetfilter
    2003,Packet rejected, ,packetfilter,packetfilter
    2009,ICMP redirect,SecureNet,packetfilter,packetfilter
    2013,FTP data,SecureNet,packetfilter,packetfilter
    2017,AFC Alert,SecureNet,packetfilter,afc
    2019,AFC Block,SecureNet,packetfilter,afc
    2021,Packet dropped (GEOIP),SecureNet,packetfilter,aptp
    2022,Packet dropped (ATP),SecureNet,packetfilter,aptp
    2101,Intrusion protection alert,SecureNet,ips,ips
    2104,ICMP flood detected,SecureNet,ips,ips
    2201,Connection started,SecureNet,vpn,html5vpn
    2202,Connection stopped,SecureNet,vpn,html5vpn
    3004,Login Success,System,auth,aua
    3005,Login Processing,System,auth,aua
    3006,Login Failure,System,auth,aua
    3100,timeout: removing session,System,confd,confd
    310a,object changed,System,confd,confd
    310c,node changed,System,confd,confd
    310n,applied changes,System,confd,confd
    3701,Authentication successful,system,up2date,up2date
    3707,Successfully synchronized fileset,system,up2date,up2date

Children
Unfiltered HTML