Accounting

[schleife]

i have a pix model 515 with vers. 5.1.2. Is there a possibillity to set up an accounting
for this machine.

Thank's .......

 

[Reaper36]

Im afraid you'll have to be a little more specific on what type of accounting you require.

 

[schleife]

i want to know, which inside nets (users) are taking to which destination outside.

 

[rspencer]

you can do a show xlate off the enable mode of the PIx if you telnet into it. Not sure if there is logging per se on this, I would love to hear anyone who knows differently.

 

[8dstaicu]

You can try to use Pix Firewall Manager but it's not so good because crash all the time.
Or something more complex like Private I (eye) but will cost you.
I make a script in Unix which analyze the syslog messages and make those statistics. i run this script when I want and get the information.

 

[abovebrd]

Could you just set up remote syslogging.

Thats what I did on my 515. It loggs more info than I know what to do with !





-Danny

 

[ScottJHall]

8dstaicu,

Where could I get a copy of the scripts to parse the data from the syslogs and report on it?

Thanks,
Scott

 

[8dstaicu]

#!/bin/sh
grep $1 /var/log/pix.log |grep 304001|awk {'print $9'}| cut -f1 -d:|sort -nb| uniq |while read address
do
host $address
done


logging it's made on a unix machine in /var/log/pix.log from syslog server.
I'm looking for 304001 message:"user@ipaddress Accessed URL 110.112.115.10:/public/index.htlm"
$1 it's the parameter when running this script. Should be IP address of the inside host that you wanna spy.
$9 means 9-th word (between two spaces)- ip address of the server that was accessed.
It's better to have on the logging machine a dns server: it will work faster.

 

[ScottJHall]

Thanks for the info.