Converting pix logs

[cspace]

hi..
i am making a program to convert pix firewall logs and have some problems.

This is the code:
/* PIX Log Converter v1.0 */
/* For importing logs into ms sql server 2000*/
/* Usage: gawk -f pix_6_302013.awk pixlog.log > pix_6_302013.csv */

/PIX-6-302013/ {
str1 = ""
str2 = ","
sub("%",str1);
sub("/",str2);
sub("to",str1);
sub(")",str2);
gsub(/)/, "");
gsub(/\x2F/, ",");
print $1,$2","$3","$5","$10","$8","$7,$12,$14,$15;
}

This is a sample of the input log:
Dec 14 14:26:27 192.168.1.105 %PIX-6-302013: Built inbound TCP connection 280325 for outside:212.20.204.32/1912 (212.20.204.32/1912) to inside:192.168.1.111/443 (212.20.204.111/443)

This is the output i get:
Dec 14,14:26:27,PIX-6-302013:,280325,TCP,inbound outside:212.20.204.32,1912 inside:192.168.1.111,443 (212.20.204.111,443

This is the output i want, but don't understand how to do:
Dec 14, 14:26:27, PIX-6-302013, 280325, TCP, inbound, outside, 212.20.204.32, 1912, inside, 192.168.1.111, 443, 212.20.204.111

i need to remove the last port number, in this case its 443.

 

[PHV]

You may try this:
sub("/",str2);sub("/[0-9]+) *$",str1)

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ222-2244

 

[cspace]

thanx..it removed the last 443, but still i need to separate each field by comma and remove the unnecessary chars

 

[PHV]

My previous post should be read:
Replace this:
sub("/",str2);
By this:
sub("/",str2);sub("/[0-9]+) *$",str1)

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ222-2244

 

[cspace]

k..i tried it and got same result

 

[PHV]

What about this ?
BEGIN{OFS=","}
/PIX-6-302013/ {
gsub(/[%:]/,"",$5)
gsub(/[\/:]/,",",$12)
gsub(/[\/:]/,",",$15)
gsub(/[(]|\/.*/,"",$16)
print $1" "$2,$3,$5,$10,$8,$7,$12,$15,$16
}

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ222-2244

 

[cspace]

thanx it solved the problem, i also realized that i can just put field separator to the problematic chars and just add the chars i needed on print..
thanx for the help.