Recent changes to bugs

Connection refused

Vince — Mon, 01 Jun 2009 20:00:07 -0000

If port 43 is blocked by the firewall this program will not work. It outputs:

connect: Connection refused
wflogs: Error: output failed.

You should fix it so it detects if the port is usable or not and then continues parsing the logs and outputting even if no reverse dns is available. This problem took me about 2 days to figure out, as I was opening up port 53 (normal DNS) instead of 43 (the port your program uses).

Hope this helps

Memory leak on Ubuntu 8.04 64bit

Lukasz Rymarczyk — Sat, 30 Aug 2008 17:56:40 -0000

Program allocale all avaiable ram.

Used command:
./wflogs -f '$start_time >= [Wed Aug 27 00:00:00 CEST 2008] && $start_time < [Wed Aug 27 00:00:00 CEST 2008 1 day]' --sort --strict-parsing=loose -i netfilter -o html --summary=true --whois_lookup=2 --mac_vendor=false --src_mac=false --dst_mac=false --duration=false -v 2 -- /var/log/kern.log

/var/log/kern.log file has only 4341 lines and 432kb size.

Used version: 0.9.8.

Issues with wflogs on ASA output

Jeremy Bresley — Tue, 29 Jul 2008 19:28:27 -0000

A Cisco ASA configured with the statement:
logging device-id hostname

Generates logs which result in multiple warnings of:
warning: line format matches none of the specified module(s): cisco_pix

Probable fix is to check for the text and also allow %ASA in addition to %PIX.

Example below:

neteng-test:/usr/share/doc/wflogs/examples/test# head -2 logs_cisco_pix1
Aug 30 17:38:52 10.0.0.1 Aug 30 2002 10:56:30: %PIX-4-106023: Deny udp src outside:10.10.0.30/3825 dst inside:10.20.0.2/37852 by access-group "outside"
Aug 30 17:38:52 10.0.0.1 Aug 30 2002 10:56:30: %PIX-4-400014: IDS:2004 ICMP echo request from 10.10.0.30 to 10.20.0.2 on interface outside
neteng-test:/usr/share/doc/wflogs/examples/test# head -2 /var/log/cisco/cisco2.log
Jul 29 09:50:29 10.1.50.2 Jul 29 2008 09:56:16 myfirewall : %ASA-6-305012: Teardown dynamic TCP translation from inside:10.2.4.82/53982 to outside:X.X.X.X/54862 duration 0:00:30
Jul 29 09:50:29 10.1.50.2 Jul 29 2008 09:56:16 myfirewall : %ASA-6-302014: Teardown TCP connection 103879231 for outside:X.X.X.X/80 to inside:10.2.4.82/54118 duration 0:00:00 bytes 1518 TCP FINs

wflogs_report grep issue

mjeveritt — Sat, 09 Oct 2004 18:35:11 -0000

wflogs_report:

I continually get the following error in the cron.daily
script where grep won't accept the '-m' switch.
I have tried getting hold of other versions of grep, but
this problem doesn't seem to go away.
Distro: Debian v3 (woody?)

Any ideas?!

Regards,
Michael.

wflogs-0.9.7 fails to compile on NetBSD 1.6.2

Adrian Portelli — Sun, 16 May 2004 13:54:36 -0000

I get the following error when tring to compile wflogs-
0.9.7 on NetBSD 1.6.2.

In file included from wflogentry.h:31,
from output_sort.cc:28:
/home/xxx/download/wflogs-0.9.7/../wfnetobjs-
0.2.1/netobjs/wfmacaddr.h:28: net/ethernet.h: No such
file or directory
*** Error code 1

Stop.
make: stopped in /home/xxx/download/wflogs-0.9.7/logs
*** Error code 1

Stop.
make: stopped in /home/xxx/download/wflogs-0.9.7
*** Error code 1

Stop.
make: stopped in /home/xxx/download/wflogs-0.9.7

The configure options were:

/configure --with-wfnetobjs-incdir=../wfnetobjs-
0.2.1/netobjs --with-wfnetobjs-libdir=../wfnetobjs-
0.2.1/lib --with-builtin-input-modules=ipfilter --with-
builtin-output-modules=ipfilter

AFAIK NetBSD does not use 'net/ethernet.h'.

adrian.

wfnetobjs 0.1.7 compile error on FreeBSD 4.7-STABLE

Joakim Ryden — Mon, 10 Feb 2003 07:51:54 -0000

gcc -c -DLOCALEDIR=\&quot;/usr/local/share/locale\&quot;
-DLOCALE_ALIAS_PATH=\&quot;/usr/local/share/locale\&quot;
-DLIBDIR=\&quot;/usr/local/lib\&quot; -DHAVE_CONFIG_H -I.. -I.
-I../intl -g -O2 dcigettext.c
dcigettext.c: In function `plural_lookup':
dcigettext.c:993: called object is not a function
*** Error code 1