WELF logs being interpreted incorrectly. Quotes problem.

WELF logs being interpreted incorrectly. Quotes problem.

I posted another message about problems with protocols not being identified and being unable to change my device settings. I believe I've found the problem. Your WELF log parser reads quotes as literal values. So when it gets a log line like (straight from the archive directory):

id=firewall time="2005-08-18 20:19:13" fw="vpn" pri=5 rule=130 proto="udp/port:1198" src=172.22.14.34 dst=84.119.100.217 sent=181 rcvd=67 duration=32 msg="Action:Permit"

It's reading items like "udp/port:1198" as \"udp/port:1198\" instead of stripping the quotes. This is occuring for all fields, which is why I'm having trouble seeing protocols and editing my device. My device is named "vpn" instead of vpn. This causes your server to generate invalid links on the device page (as well as other pages) and causes protocols to be interpreted incorrectly.

My firewall is a netscreen 208 setup to send Webtrends logs to FWA.





                New to ADSelfService Plus?