Viewing archived log files

[misjay01]

Hello,

I am using fw logswitch command to create new log file everyday and archive the old file. These log files are zipped and placed in another directory.

However, when I tried to view the files from log viewer it failed.

Is there a way to view this file again. I guess the log files would need the associated .PTR file ?? or do I ?

Also does anyone have a script for WIN2K to archive .PTR files ?

TIA

 

[whostolemyhandle]

fwlogexport -n -i <nameofinputlogfile> -o <nameofoutputtxtfile>

Do this on the management station and you will get an ASCII readable log file. As long as the objects.C file is on the machine it will recreate the .ptr file The first line of this file defines the column headings. The columns can change from time to time and each time you get a new column definition record - so watch out for that.

I too assume that the relevent .ptr file is required for the GUI viewer for binary files but the use and purpose of that file is something that I am still investigating, especially from a forensic point.