I have cooked some solution (Sorry this is only for Linux/Unix type of
servers as it is based on logger. Unless you want to install cygwin on
your windows server and run this script via cygwin shell) Hope this may
help others. You can fine tune fw log -f -t ... command in the script
below to suit your need.
To start
/etc/init.d/checkpoint_fwlogs start
To stop
/etc/init.d/checkpoint_fwlogs stop
-------------------------------------------------------------------------
(*)Boot script (put under /etc/init.d/checkpoint_fwlogs , run chkconfig etc)
-------------------------------------------------------------------------
#!/bin/sh
# rajeev@rajeevnet.com (Sept/22/2005)
# chkconfig: - 99 30
# description: This is a checkpoint logger to syslog
#- Logger
LOGGER="/usr/bin/logger"
#- Local command errors goes to file
LOCAL_ERRORS="/var/log/checkpoint_fw.log"
#- Syslog Facility
FACILITY="user"
#- Syslog Level
LEVEL="alert"
#--- If you want to collect these logs in different file on your
#--- syslog server
#---- define something like below. Assuming user.alert syslog facilit.
#user.alert /var/log/checkpoint_fw.log
##--- No Need to modify below this ------------------------##
#-Check if any other fw log process is running
OLD_PID=`ps -ef | grep "fw log" |grep -v grep | awk '{print $2}'`
case "$1" in
'start')
if [ $OLD_PID ]; then
echo "!!!------------------------------------------!!!!!"
echo " ALERT:: Another log process is running with pid
$OLD_PID . First kill that process. Exiting..."
echo "!!!------------------------------------------!!!!!"
exit 1
fi
echo "Sending Checkpoint logs to syslog .."
#Throw all logs to syslog.
$FWDIR/bin/fw log -f -t -l -o 2>>$LOCAL_ERRORS | $LOGGER -p
$FACILITY.$LEVEL >/dev/null 2>&1 &
;;
'stop')
if [ $OLD_PID ]; then
echo "Killing fw log process with PID $OLD_PID"
kill $OLD_PID
fi
echo "Stopped ......"
;;
*) echo "Usage: $0 { start | stop }"
;;
esac
------------------------------------------------------------------------------
Hope this helps.
Rajeev K.
contrera@eig.unige.ch wrote:
Hi,
I need to redirect my checkpoint firewall logs to a syslog server.
I've founded the following url that describe a trick for being able to redirect
the fw1 log to syslog but it works only on Linux :
http://wyae.de/docs/fw1syslog.php
My checkpoint host is on windows so i can't use this.
Someone knows a solution for a windows host ?
Thanks a lot
