search

certego / fw1-loggrabber

FW1-Loggrabber is a command-line tool to grab logfiles from remote Checkpoint devices using OPSEC LEA (Log Export API)
GNU General Public License v2.0
52 stars 35 forks source link

[Feature] contribution Add fileid, commandline arguments and last_record_location #42

Open nisargshah-crest opened 6 years ago

nisargshah-crest commented 6 years ago

I want to add fileid in each events where fileid is unique id of each fw.log.

nisargshah-crest commented 6 years ago

I have created the pull request for the same. @adepasquale Can you please review it?

41

nisargshah-crest commented 6 years ago

I have also added below commits in the fork branch

Changes contains two parts: (1) Added the fileid in the events where fileid is the unique id of each fw.log links:

(2) Added code to support last_record_location along with the read cursor file.

Description about last_record_location:

Support of the last_record_location along with the cursorfile. We should able to pass the last_record_location as commandline argument. last_record_location would be like

{fileid:loc} i.e. {123333:3232} . We can use this parameter to get the events from the particular location. So if we pass the commandline argument last_record_location, We will use the argument instead of the cursor file.

(1) If current fileid matches with the --last_record_location fileid then only we will use the loc to get the next events from the same fileid. (2) If current fileid will not match with the stored fileid then we will read the whole fw.log file.

(3) Command line arguments along with fw1-loggrabber.conf and lea.conf