WebTrends Enhanced Log Format
Prev | Chapter 10. Firewall Supported Log Formats | Next

## WebTrends Enhanced Log Format

The WELF format is a format developed by WebTrends and supported by many firewall vendors. Products can save log files in that format directly or can log through syslog. Either native WELF log files or syslog's log files contain WELF information. Although the log format isn't designed for packet filter firewalls (it can contain information from devices that do network intrusion or proxy services), Lire does its best to map this information to something that can be meaningful.

Example 10.5. WELF Log Sample

    WTsyslog[1998-08-01 14:05:46 ip=10.0.0.1 pri=6] id=firewall \
        time="1998-08-01 04:10:23" fw=WebTrendsSample pri=5 \
        msg="ICMP packet dropped" src=10.0.0.2 dst=10.0.0.3 rule=3
    WTsyslog[1998-08-01 16:31:00 ip=10.0.0.1 pri=6] id=firewall \
        time="1998-08-01 10:35:38" fw=WebTrendsSample pri=6 \
        proto=tcp/443 src=10.0.0.4 dst=10.0.0.5 rcvd=4844
    WTsyslog[1998-08-01 16:31:01 ip=10.0.0.1 pri=6] id=firewall \
        time="1998-08-01 10:35:38" fw=WebTrendsSample pri=6 proto=tcp/443 \
        src=10.0.0.4 dst=10.0.0.5 rcvd=6601
    WTsyslog[1998-08-01 16:43:59 ip=10.0.0.1 pri=6] id=firewall \
        time="1998-08-01 10:48:36" fw=WebTrendsSample pri=5 \
        msg="UDP packet dropped" src=10.0.0.6 dst=10.0.0.3 rule=3
    WTsyslog[1998-08-01 16:46:13 ip=10.0.0.1 pri=6] id=firewall \
        time="1998-08-01 10:50:50" fw=WebTrendsSample pri=5 \
        msg="UDP packet dropped" src=10.0.0.7 dst=10.0.0.3 rule=3
    WTsyslog[1998-08-01 16:46:13 ip=10.0.0.1 pri=6] id=firewall \
        time="1998-08-01 10:50:50" fw=WebTrendsSample pri=6 proto=telnet \
        src=10.0.0.4 dst=10.0.0.8 sent=1194

Lire also supports some extension uses by SonicWall.

Example 10.6. SonicWall Log Sample

    Jan  7 15:01:10 lire id=firewall sn=asdlFFFXSD \
        time="2002-01-06 22:42:13" fw=10.0.0.1 pri=6 c=1 m=30 \
        msg="Administrator login failed - incorrect password" n=1 \
        src=10.0.0.2:LAN dst=10.0.0.1
    Jan  7 15:01:16 lire id=firewall sn=asdlFFFXSD \
        time="2002-01-06 22:42:19" fw=10.0.0.1 pri=6 c=1 m=29 \
        msg="Successful administrator login" n=1 src=10.0.0.2:LAN dst=10.0.0.1
    Jan  7 15:02:32 lire id=firewall sn=asdlFFFXSD \
        time="2002-01-06 22:43:34" fw=10.0.0.1 pri=5 c=128 m=37 \
        msg="UDP packet dropped" n=1 src=10.0.0.3:68 dst=10.0.0.4:67 dstname=DHCP
    Jan  7 15:31:43 lire id=firewall time="2002-01-07 15:20:21" \
        fw=10.0.0.5 pri=6 proto=dns src=10.0.0.6 dst=10.0.0.8 rcvd=130 \
        sn=asdlFFFXSD 54 c=1024 m=98 n=31
    Jan  7 15:31:43 10.0.0.5 id=firewall time="2002-01-07 15:20:21" \
        fw=10.0.0.5 pri=6 proto=dns src=10.0.0.6 dst=10.0.0.9 rcvd=130 \
        sn=asdlFFFXSD 54 c=1024 m=98 n=32

Prev | Up | Next
IPTables | Home | Chapter 11. FTP Supported Log Formats