Symantec Endpoint Protection (SEP) firewall logs

[fervin]

Hello All,

Has anyone figured out a good way to perform field extractions on the data contained in SEP firewall logs? The SEP firewall syslog is pretty messy in how it presents the data and although we've gotten some usable results, it's far from polished. This is due mainly to the unpredictability of the way it logs events, with a variable number of fields depending on the nature of the firewall event. Thanks in advance,

-Frank

[Splunker]

Try using a forwarder on your SEP server as SEP puts logs in various files.

It might be easier parsing the logs if you know what logs to expect in each file (input).

I ran across the same problem trying to sort the logs from SEP that are being sent via syslog (their missing event codes such as the Cisco PIX uses).

As an aside, the Splunk ESS suite understands SEP logs, but i'm not sure how exactly.

Hoe it helps.