fwctlreport - Generates text reports from fwctllog output.
fwctlreport [--start report_start] [--end report_end | --period report_period ] [--threshold cutoff_threshold] [--limit expression] [--nohostname] [--report report ...] logfile ...
fwctlreport --help
fwctlreport can be use to generates several kind of reports from the kernel packet filters logs once processed by fwctllog.
The records on which the report will be generated can be customized with the following options.
Sets the start of the report's period. If the Date::Manip(3) module is installed, you can use any format that this module can parse. If that module is'nt installed you must use the following format YYYY-MM-DD HH:MM:SS or any meaningful subset of that format.
If this option is not used, the report will start with the first record.
Sets the end of the report's period. If the Date::Manip(3) module is installed, you can use any format that this module can parse. If that module is'nt installed you must use the following format YYYY-MM-DD HH:MM:SS or any meaningful subset of that format.
If this option is not used, the report will end with the last record.
Sets the length of the report's period. This length is interpreted relative to the report's start. This option has priority over the end option.
If you have the Date::Manip module installed, you can use any format that this module can parse. If that module isn't available, you can use a subset of the following format X weeks X days X hours X mins X secs.
This option will removed records identical in protocol, destination ports, source addresses and destination addressesses that appears in the time window specified by the threshold parameters. Defaults is 120 (2 minutes). Use 0 to generates reports for all the packets.
This parameter can be used to restrict the records over which the report is generated. It is an expression which will be used to select a subset of all the records. You can use the following fields : src_ip, dst_ip, src_host, dst_host, action, device, src_port, dst_port, src_serv, dst_serv, proto, proto_name, and the following operator =, !=, <, >, <=, >=, /regex/, /regex/i. Those operators have the same meaning as in perl. You can also use parentheses and the following logic operator : or, and, not .
If you usee nohostname, only the IP address will appear in the report, even if the hostname is available.
You can use this option to specify the reports that will be generated. By default, the details report is generated.
Here are the reports that can be generated :
Report that shows the number of log entry for each services.
Report that shows the time, action and source host logged for each services.
Report that shows the number of log entry for each destination host / service.
Report that shows the time, action and source host logged for each destination host / service.
Report that shows the number of log entry for each destination alias / service.
Report that shows the time, action and source host logged for each destination alias / service.
Report that shows the number of log entry for each destination alias.
Report that shows the time, action, source host and service logged for each destination alias.
Report that shows the number of log entry for each destination host.
Report that shows the time, action, source host and service logged for each destination host.
Report that shows the number of log entry for each source alias.
Report that shows the time, action, destination host and service logged for each source alias.
Report that shows the number of log entry for each source host.
Report that shows the time, action, destination host and service logged for each source host.
Reports that shows all the information associated with each log entry.
Francis J. Lacoste <francis.lacoste@iNsu.COM>
Copyright (c) 2000 iNsu Innovations Inc. All rights reserved.
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, you can get one at http://www.gnu.org/copyleft/gpl.html
Fwctl(3) Fwctl::RuleSet(3) fwctl(8) fwctllog(8) Fwctl::Report(3).
1 POD Error
The following errors were encountered while parsing the POD:
You forgot a '=back' before '=head1'
To install Fwctl, copy and paste the appropriate command in to your terminal.
cpanm
cpanm Fwctl
CPAN shell
perl -MCPAN -e shell install Fwctl
For more information on module installation, please visit the detailed CPAN module installation guide.