Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 19: Auditing and Reporting
Formatting & exporting audit data for use with external tools
Using Sidewinder G2 formatting and exporting tools
You initiate the formatting and exporting process on the Sidewinder G2 using
acat or the Sidewinder export utility (cf export). These tools allow you to
format raw audit data collected by the Sidewinder G2 into SEF, WELF, HTTP,
Squid, or generic (gen) files.
Using acat
acat converts data, but does not export it. To format Sidewinder G2 audit data
using acat, follow the steps below.
1 Using a command line session, log into the Sidewinder G2 and type the
following command to switch to the admn role:
srole
2 Change directories so that your present working directory (pwd) is where
you want the converted files saved.
3 To convert your logs to an exportable format and save them to a file, enter
the following command:
acat -X /var/log/auditfile > filename.format
where
• -X indicates the new format. Use -X for SEF, -H for W3C, and
-W for Webtrends. Note that all of these arguments are capital letters.
• auditfile is the log file to convert.
• filename.format is the new file name and format, such as
audit012006.sef. Formats include sef, http, wt, squid, and gen.
For example:
acat -X /var/log/audit.raw.2006...CST.gz > audit.sef
converts the existing audit file into the SEF format and saves it to a file
named audit.sef.
The specified file is now converted and ready to be manually exported via FTP
or another method.
Using cf export
The cf export utility both converts and exports the specified log files to a
destination host you specify. This utility can also be used to create a cron job
that automatically initiates an FTP export program once every 24 hours. The
FTP export program uses FTP to transfer the export files from the Sidewinder
G2 to the host you specify. The host can be on a trusted network protected by
the Sidewinder G2, or it can be a host that resides somewhere on the Internet.
561