/usr/share/doc/lire/user-manual/ch10s05.html is in lire-doc 2:2.1.1-2.1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>WebTrends Enhanced Log Format</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2"><link rel="home" href="index.html" title="Lire User's Manual"><link rel="up" href="ch10.html" title="Chapter 10. Firewall Supported Log Formats"><link rel="prev" href="ch10s04.html" title="IPTables"><link rel="next" href="ch11.html" title="Chapter 11. FTP Supported Log Formats"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">WebTrends Enhanced Log Format</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ch10s04.html">Prev</a> </td><th width="60%" align="center">Chapter 10. Firewall Supported Log Formats</th><td width="20%" align="right"> <a accesskey="n" href="ch11.html">Next</a></td></tr></table><hr></div><div class="section" title="WebTrends Enhanced Log Format"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id383818"></a>WebTrends Enhanced Log Format</h2></div></div></div><p>The WELF format is a format developed by WebTrends and
supported by many firewall vendors. Products can save log
files in that format directly or can log through
<span class="command"><strong>syslog</strong></span>. Either native WELF log
files or <span class="command"><strong>syslog</strong></span>'s log files contain
WELF information. Although the log format isn't designed
for packet filter firewalls (it can contain information
from devices that do network intrusion or proxy
services), <span class="application">Lire</span> does its best to map this information to
something that can be meaningful.
</p><div class="example"><a name="id383869"></a><p class="title"><b>Example 10.5. WELF Log Sample</b></p><div class="example-contents"><pre class="programlisting">
WTsyslog[1998-08-01 14:05:46 ip=10.0.0.1 pri=6] id=firewall \
time="1998-08-01 04:10:23" fw=WebTrendsSample pri=5 \
msg="ICMP packet dropped" src=10.0.0.2 dst=10.0.0.3 rule=3
WTsyslog[1998-08-01 16:31:00 ip=10.0.0.1 pri=6] id=firewall \
time="1998-08-01 10:35:38" fw=WebTrendsSample pri=6 \
proto=tcp/443 src=10.0.0.4 dst=10.0.0.5 rcvd=4844
WTsyslog[1998-08-01 16:31:01 ip=10.0.0.1 pri=6] id=firewall \
time="1998-08-01 10:35:38" fw=WebTrendsSample pri=6 proto=tcp/443 \
src=10.0.0.4 dst=10.0.0.5 rcvd=6601
WTsyslog[1998-08-01 16:43:59 ip=10.0.0.1 pri=6] id=firewall \
time="1998-08-01 10:48:36" fw=WebTrendsSample pri=5 \
msg="UDP packet dropped" src=10.0.0.6 dst=10.0.0.3 rule=3
WTsyslog[1998-08-01 16:46:13 ip=10.0.0.1 pri=6] id=firewall \
time="1998-08-01 10:50:50" fw=WebTrendsSample pri=5 \
msg="UDP packet dropped" src=10.0.0.7 dst=10.0.0.3 rule=3
WTsyslog[1998-08-01 16:46:13 ip=10.0.0.1 pri=6] id=firewall \
time="1998-08-01 10:50:50" fw=WebTrendsSample pri=6 proto=telnet \
src=10.0.0.4 dst=10.0.0.8 sent=1194
</pre></div></div><br class="example-break"><p><span class="application">Lire</span> also supports some extension uses by
SonicWall.</p><div class="example"><a name="id383888"></a><p class="title"><b>Example 10.6. SonicWall Log Sample</b></p><div class="example-contents"><pre class="programlisting">
Jan 7 15:01:10 lire id=firewall sn=asdlFFFXSD \
time="2002-01-06 22:42:13" fw=10.0.0.1 pri=6 c=1 m=30 \
msg="Administrator login failed - incorrect password" n=1 \
src=10.0.0.2:LAN dst=10.0.0.1
Jan 7 15:01:16 lire id=firewall sn=asdlFFFXSD \
time="2002-01-06 22:42:19" fw=10.0.0.1 pri=6 c=1 m=29 \
msg="Successful administrator login" n=1 src=10.0.0.2:LAN dst=10.0.0.1
Jan 7 15:02:32 lire id=firewall sn=asdlFFFXSD \
time="2002-01-06 22:43:34" fw=10.0.0.1 pri=5 c=128 m=37 \
msg="UDP packet dropped" n=1 src=10.0.0.3:68 dst=10.0.0.4:67 dstname=DHCP
Jan 7 15:31:43 lire id=firewall time="2002-01-07 15:20:21" \
fw=10.0.0.5 pri=6 proto=dns src=10.0.0.6 dst=10.0.0.8 rcvd=130 \
sn=asdlFFFXSD 54 c=1024 m=98 n=31
Jan 7 15:31:43 10.0.0.5 id=firewall time="2002-01-07 15:20:21" \
fw=10.0.0.5 pri=6 proto=dns src=10.0.0.6 dst=10.0.0.9 rcvd=130 \
sn=asdlFFFXSD 54 c=1024 m=98 n=32
</pre></div></div><br class="example-break"></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ch10s04.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="ch10.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="ch11.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">IPTables </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 11. FTP Supported Log Formats</td></tr></table></div></body></html>
|