Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 2 subscribers
  • Views 1289 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Network Protection Daily Report. fwrule=, id=

TrevorFurnell
Hi;

Trying to marry up some of the reports in the Astaro, against Splunk.

In the UTM Logging and Reporting section, Network Protection, Daily report.
I'm trying to work out, exactly what events make up the graph.

below is one of the records that Splunk recorded
Dec 20 21:19:43 astaro 2013: 12:20-21:19:43 ulogd[4443]: id="2102" severity="info" sys="SecureNet" sub="ips" name="portscan detected" action="portscan" fwrule="60017" initf="ppp0" srcip="456.456.456.456" dstip="123.123.123.123" proto="6" length="44" tos="0x00" prec="0x00" ttl="228" srcport="44655" dstport="426" tcpflags="SYN" 

Here is another record from Splunk
Dec 20 21:19:43 astaro 2013: 12:20-21:19:43 ulogd[4443]: id="2103" severity="info" sys="SecureNet" sub="ips" name="SYN flood detected" action="SYN flood" fwrule="60012" initf="ppp0" srcip="456.456.456.456" dstip="123.123.123.123" proto="6" length="44" tos="0x00" prec="0x00" ttl="228" srcport="44655" dstport="421" tcpflags="SYN"

I'm trying to decipher which of the above fields are common, and will allow me to pick up all the UTM "Firewall Violations", so far sys="SecureNet" and sub="ips" stand out. I'm guessing id and fwrule (provided I can work out the complete list of matching numbers) would be another good starting point.

Is there a list of all "id" numbers and what they mean, likewise fwrule list..

Trevor..


This thread was automatically locked due to age.
Parents
  • 0
    Hi, the 'id' is the process ID, which is irrelevant.

    The fwrule is relevant. The ones starting from 60,000 are built-in rules, and others are your user-added firewall rules.

    There's a list of the built-in ones somewhere, but I can't find it atm.

    For the IPS log, you'd want to look at the SID.
    There's lists of all the IPS SIDs/rules at 
    https://www.astaro.com/lists/

    Barry


    Barry
Reply
  • 0
    Hi, the 'id' is the process ID, which is irrelevant.

    The fwrule is relevant. The ones starting from 60,000 are built-in rules, and others are your user-added firewall rules.

    There's a list of the built-in ones somewhere, but I can't find it atm.

    For the IPS log, you'd want to look at the SID.
    There's lists of all the IPS SIDs/rules at 
    https://www.astaro.com/lists/

    Barry


    Barry
Children
No Data