Lire::WELF3pm
Base implementation of a webtrends(tm) enhanced log format parser
Usage
use Lire::WELF;
my $parser = new Lire::WELF;
my $welf_rec = $parser->parse( $line );
Overview
This module defines an object able to parse WebTrends(tm) Enhanced Log Format. That log format was defined by WebTrends(tm) for its Firewall Suite. It defines an extensible format that is now used by several packet filter and/or proxy firewall.
The document describing that format is available from http://www.webtrends.com/partners/welfOverview.htm
A list of products/vendor that supports this format can be found at http://www.webtrends.com/partners/firewall.htm
You create a WELF parser object using the new() method:
my $parser = new Lire::WELF();To parse a WELF record you invoke the parser() method with the line containing the record as parameter:
my $rec = $parser->parse( $line );The $rec is an hash reference with the WELF field name used as keys and the value of the records as values.
No value are interpreted or checked in any except for the following:
time
|
The time field will be converted to epoch time |
|---|---|
quotation
|
The quotation marks used when the value contains spaces are removed. |
Welf extensions
The parser also supports "extensions" to the format found in the field.
- port
-
We will interpret correctly src and dst fields that have the port embededded in them:
src=192.168.1.1:1037
- interface
-
A possible :IFNAME will also be interpreted as the interface name:
dst=192.168.100.10:23:WAN
- timezone
-
The time field may contains a time zone identifier:
time="2001-12-02 12:34:12 UTC"
Derived Fields
The parser will generate a few 'derived' to complete the format.
- src_port
-
Will contain the src port portion of the dst field when SonicWall extensions are used.
- dst_port
-
Will contain the interface portion of the dst field when SonicWall extensions are used.
- src_if
-
Will contain the interface portion of the src field when SonicWall extensions are used.
- dst_if
-
Will contain the interface portion of the dst field when SonicWall extensions are used.
Version
$Id: WELF.pm,v 1.11 2006/07/23 13:16:30 vanbaal Exp $
Releases
7 releases since Debian 3.0 (Woody); the text changed 6 times.