Decoding the Syslog Firewall Line
-
I am starting to send my firewall logs to a syslog server (splunk) and bring them into it. When looking at the line, I was wondering if anybody had a meaning of each column. For example…
May 28 10:08:05 10.0.110.1 May 28 10:08:05 filterlog: 126,16777216,,0,vmx0,match,block,in,4,0x20,,47,14551,0,DF,6,tcp,52,<src ip="">,<dst ip="">,3228,23,0,S,1544514489,,7300,,mss;sackOK;wscale;eol</dst></src>Month | Day | Time | Syslog Source IP | Monday | Date | Time | Source | Something | Something | ,, | Something | NIC | match | action | direction | tcp flag? | something | something | tcp flag? | something | protocol | something | source IP | destination IP | something | something | something | TCP syn |…..etc.
Some things I know, but others I don't. Thanks in advanced.
-
https://doc.pfsense.org/index.php/Filter_Log_Format_for_pfSense_2.2
