Sawmill Discussion Forum - IMSS log format recognized but empty reports

Welcome to Sawmill.Net

Sawmill Discussion Forum

Subject: "IMSS log format recognized but empty reports"

Conferences Support Topic #2492
Printer-friendly copy Email this topic to a friend
Reading Topic #2492

lcasti
Member since Jul-13-05
3 posts

Jul-13-05, 04:37 AM (PDT)

Click to add this user to your buddy list

"IMSS log format recognized but empty reports"

We are testing sawmill 7.1.11 trial with IMSS (Interscan Messaging Security Suite Format). Sawmill recognize the log, but don't analyze it. The reports give all fields blanks, as if it cannot get the log fields that however are present in the log file.
Can someone help?
Thanks.
Luca.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

RE: IMSS log format recognized but empty reports, i21, Jul-17-05, 01:35 PM, (1)
- RE: IMSS log format recognized but empty reports, lcasti, Jul-18-05, 01:33 AM, (2)
  - RE: IMSS log format recognized but empty reports, i21, Jul-18-05, 11:33 PM, (3)
    - RE: IMSS log format recognized but empty reports, lcasti, Jul-19-05, 00:23 AM, (4)
      - RE: IMSS log format recognized but empty reports, i21, Jul-19-05, 02:08 AM, (5)
        
        RE: IMSS log format recognized but empty reports, lcasti, Jul-20-05, 00:55 AM, (6)

Conferences | Topics | Previous Topic | Next Topic

i21
Member since Mar-21-02
1624 posts

Jul-17-05, 01:35 PM (PDT)

1. "RE: IMSS log format recognized but empty reports"
In response to message #0

I have been doing some work on thise recently. This is the latest version (which works but has not finished final testing to go into the code release):

http://www.sawmill.co.uk/formats/interscan_security_suite.zip

Unzip and drop it into "/sawmill 7/loganalysisinfo/log_formats/" (copy over the old one or back it up (not much point in that if it dowesn't work though)) and create a new profile.

Any better?

Let me know if you have any more problems, or if you want any changes made.

Cheers,
--
Graham
Sawmill UK

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top