Fwctl::Report - Generates reports from fwctllog output.
use Fwctl::Report; my $report = new Fwctl::Report( options ... ); my $src_alias_sum = $report->src_alias_summary_report; foreach my $r ( @$src_alias_sum ) { print $r->{host_ip}, " = ", $r->{count}, "\n"; }
The Fwctl::Report(3) module can be used to generate various reports from the output of the fwctllog program.
This module generates two kinds of report summary and <report>. The summary compiles the number of occurence for an item (source, destination, service, etc.). The report methods will returns all the log entry that shares the same key ( source, destination, service, etc.)
summary
Ex. my $report = new Fwctl::Report( start => 'yesterday', period => '1 day', files => [ 'log' ] );
The new method accepts the following parameter :
new
Specifies the file from which to read the fwctllog output. It is an array of file handle or file names. If this parameter is not specified the records will be read from STDIN.
Sets the start of the report's period. If the Date::Manip(3) module is installed, you can use any format that this module can parse. If that module is'nt installed you must use the following format YYYY-MM-DD HH:MM:SS or any meaningful subset of that format.
If this option is not used, the report will start with the first record.
Sets the end of the report's period. If the Date::Manip(3) module is installed, you can use any format that this module can parse. If that module is'nt installed you must use the following format YYYY-MM-DD HH:MM:SS or any meaningful subset of that format.
If this option is not used, the report will end with the last record.
Sets the length of the report's period. This length is interpreted relative to the report's start. This option has priority over the end option.
If you have the Date::Manip module installed, you can use any format that this module can parse. If that module isn't available, you can use a subset of the following format X weeks X days X hours X mins X secs.
This option will removed records identical in protocol, destination ports, source addresses and destination addressesses that appears in the time window specified by the threshold parameters. Defaults is 120 (2 minutes). Use 0 to generates reports for all the packets.
This parameter can be used to restrict the records over which the report is generated. It is an expression which will be used to select a subset of all the records. You can use the following fields : src_ip, dst_ip, src_host, dst_host, action, device, src_port, dst_port, src_serv, dst_serv, proto, proto_name, and the following operator =, !=, <, >, <=, >=, /regex/, /regex/i. Those operators have the same meaning as in perl. You can also use parentheses and the following logic operator : or, and, not .
Return the start of the report in seconds since epoch.
Returns the end of the report in seconds since epoch.
Returns the length of the report's period ( $report->end() - $report->start() )
Returns an array reference to all the records read and which makes the report's sample.
Each record is an array ref. You can accessed the individual fields of the record by using the following constants. (Those can be imported by using the :fields import tag.)
:fields
The epoch time of the log entry.
The resulting action (ACCEPT,DENY,REJECT).
The physical device on which the packet was logged.
The Fwctl(3) interface to which this device is related.
The kernel chain on which that packet was logged.
The protocol number.
The name of the protocol.
The source address of the packet.
The source hostname.
The Fwct(3) interface related to the source address.
The Fwctl(3) alias associated to the source address.
The source port of the logged packet.
The service name associated to the logged packet.
The destination IP of the packet.
The destination hostname.
The Fwctl(3) interface associated with the destination address.
The Fwctl(3) alias related to the destination address.
The destination port number.
The service name of the the destination port.
The following report generation methods are available :
my $r = $report->service_summary_report();
Generates a report that shows the number of log entries for each services.
The resulting report is an array ref of hash reference. Each report record's has the following fields.
The protocol name.
The destination port.
The destination service's name.
If the protocol is not UDP or TCP, the source port.
If the protocol is not UDP or TCP, the service name associated to the source port.
The number of log entries matching the service.
The epoch time of the first occurence.
The epoch time of the last occurence.
my $r = $report->service_report();
Generates a report that sort the log entries by service.
The report is an array of arrays. Each elements of the report is an array of records which shares the same service.
my $r = $report->service_alias_summary_report();
Generates a report that shows the number of log entries for each destination aliases / service.
The alias of the destination hosts.
The destination's service name.
The number of log entries.
my $r = $report->service_alias_report();
Generates a report that sort the log entries by destination alias and service.
The report is an array of arrays. Each elements of the report is an array of records which shares the same destination alias and service.
my $r = $report->service_host_summary_report();
The destination host ip address.
The destination host name.
The alias of that host.
my $r = $report->service_host_report();
Generates a report that sort the log entries by destination host and service.
The report is an array of arrays. Each elements of the report is an array of records which shares the same destination host and service.
Generates a report that shows the number of log entries for each source aliases.
The source alias.
my $r = $report->src_alias_report();
Generates a report that sort the log entries by source alias.
The report is an array of arrays. Each elements of the report is an array of records which shares the same source alias.
my $r = $report->src_host_summary_report();
Generates a report that shows the number of log entries for each source host.
The source host ip address.
The source host name.
The alias of the source host.
my $r = $report->src_host_report();
Generates a report that sort the log entries by source host.
The report is an array of arrays. Each elements of the report is an array of records which shares the same source host.
my $r = $report->dst_alias_summary_report();
Generates a report that shows the number of log entries for each destination aliases.
The destination alias.
my $r = $report->dst_alias_report();
Generates a report that sort the log entries by destination alias.
The report is an array of arrays. Each elements of the report is an array of records which shares the same destination alias.
Generates a report that shows the number of log entries for each destination hosts.
my $r = $report->dst_host_report();
Generates a report that sort the log entries by destination host.
The report is an array of arrays. Each elements of the report is an array of records which shares the same destination host.
Francis J. Lacoste <francis.lacoste@iNsu.COM>
Copyright (c) 2000 iNsu Innovations Inc. All rights reserved.
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
Fwctl(3) Fwctl::RuleSet(3) fwctl(8) fwctllog(8) Fwctl::Report(3) Date::Manip(3).
To install Fwctl, copy and paste the appropriate command in to your terminal.
cpanm
cpanm Fwctl
CPAN shell
perl -MCPAN -e shell install Fwctl
For more information on module installation, please visit the detailed CPAN module installation guide.