hi.
i need a bit of help here.. what i am trying to do is a pretty easy
thing to do (or would be for someone who understands vbscript)
i have some syslog messages from a cisco pix that i need to parse into
relavant information.
i have this so far which gives me the eventid, but i need to get out
the source and destination ip's and ports.
if anyone can help, i'd much apreciate it!
thanks in advance,
Rob
here is the script as it is:
Function Main()
' Set the return value to OK
Main = "OK"
' By default, skip to the next rule, don't take the actions that
follow
' If we exit the function before we get to the end, the default 'skip
to next rule'
' will be used.
Fields.ActionQuit = 100
' Example of a PIX message
' %PIX-4-209004: Invalid IP fragment...
' %PIX-3-106011: Deny inbound (No xlate) udp src
outside:192.168.40.15/138 dst outside:192.168.40.255/138
' %PIX-3-305005: No translation group found for tcp src
inside:192.168.200.157/2635 dst outside:195.44.45.243/25
' %PIX-2-106016: Deny IP spoof from (127.0.0.1) to 212.85.6.13 on
interface outside
Dim M ' Message
Dim E ' Explanation
Dim A ' Action
' Copy message to local variable for speed
M = Fields.VarCleanMessageText
' If message length is too short, exit function
If Len(M) < 15 then exit function
' Grab the first 15 chrs
M = Left(M,15)
' Check the message is a valid PIX message
If Mid(M,1,5) <> "%PIX-" then exit function
' Add any additional checks you want to perform here
E = ""
' Grab the important part ("4-209004")
E = Mid(M,8,6)
A = ""
' Exit if we don't have any values to pass
' If len() = 0 then exit function
' If len(A) = 0 then exit function
' Pass the Explanation and Action to take to the custom variables
Fields.VarCustom01 = E
' Use the 2 custom variables in a "Log to ODBC database" action
' or the custom fields can be passed into a "Send e-mail" action as
the message body.
' Since we have a valid match, we want to execute the send e-mail
action which follows.
' Setting ActionQuit to 0 means we won't skip any actions.
Fields.ActionQuit = 0
End function