<html>

<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 10 (filtered)">

<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
p
        {margin-right:0in;
        margin-left:0in;
        font-size:12.0pt;
        font-family:"Times New Roman";}
span.EmailStyle17
        {font-family:Arial;
        color:windowtext;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
 /* List Definitions */
 ol
        {margin-bottom:0in;}
ul
        {margin-bottom:0in;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=purple>

<div class=Section1>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I wanted to say thanks to all who responded to my question
regarding parsing syslog files.</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thanks!</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>But, I was wondering about check_log. It seems that it would
work for my environment. However I see that I have run into a snag of sorts.</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I’m parsing out Cisco PIX logs, and was able to parse
out “Deny” type logs successfully. However, I’m only getting
part of the syslog message.</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Here is what I receive in MySQL:</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal style='margin-left:40.5pt;text-indent:-22.5pt'><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>(36)<font size=1
face="Times New Roman"><span style='font:7.0pt "Times New Roman"'>   
</span></font></span></font><font size=2 face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Mar  3 </span></font><font
 size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>14:22:11</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> secure-primary
</span></font><font size=2 face=Arial><span style='font-size:10.0pt;font-family:
 Arial'>Mar 03 2006</span></font><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'> </span></font><font
 size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>14:59:44</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>:</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>If I look at the Nagios log (External Commands) I also see
the “chopped” line, so it appears to be occurring during the
parsing process.</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Here is the syslog entry:</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Mar  3 </span></font><font size=2 face=Arial><span
 style='font-size:10.0pt;font-family:Arial'>14:22:11</span></font><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> secure-primary </span></font><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>Mar 03 2006</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>14:59:44</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>:
%PIX-4-106023: Deny udp src inside:10.xxx.xxx.xxx/12346 dst EXTRANET:192.168.xx.xx/12345
by access-group "inside"</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>It appears to be failing at the “%” on the syslog
entry. </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thanks in advance,</span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Mike</span></font></p>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>

</div>

</body>

</html>