# # Need to verify drive and path below to correct syslog directory # Bobby Brown # bbrown@netsecadmin.com # ################################################################################# # Get info from form to store in buffer (For post method only) read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'}); # Split the name-value pairs @pairs = split(/&/, $buffer); # Split the names and assign variables foreach $pair (@pairs) { ($name, $value)=split(/=/,$pair); $value=~ tr/+/ /; $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg; $FORM{$name}=$value; } #User form to set variables $count = "$FORM{'alerts'}"; $type = $FORM{'type'}; $eventtype = $FORM{'eventtype'}; $filename = $FORM{'filename'}; $Search = $FORM{'search'}; $Searchyes = $FORM{'searchyes'}; ##### Set drive and directory to your syslog log directory open (F,"d:\\temp\\tmp") ; #Reverse the file so most current is first in file when dumped. print R reverse ; close R ; close F ; ($Y,$M,$D,$z) = split(/\-/,$filename,4) ; print "Content-type: text/html \n\n"; print <<"EOL";

Most recent $count alerts from $M-$D-$Y

IDS color codes - Priority 4 Priority 6 Priority 10

EOL open (R,") { #If cases to print seletect type of syslog entries chomp; ($date,$t,$f,$h,$mess) = split(/\t/,$_,5) ; if ( ($type eq "snort") && ($mess !~ /snort\[/) ) {next; } if ( ($type eq "asgsentry") && ($mess !~ /^SNMP/) ) {next; } if ( ($type eq "EvntSLog") && ($mess !~ /^EvntSLog/) ) {next; } if ( ($type eq "EvntSLog") && ($eventtype eq "AUF") && ($mess !~ /AUF/) ) {next; } if ( ($type eq "EvntSLog") && ($eventtype eq "ERR") && ($mess !~ /ERR/) ) {next; } if ( ($Searchyes) && ($mess !~/$Search/) ) {next; } print <<"EOF"; EOF # If cases to change colors of the table rows if ($mess =~ /AUF/) { print "" ; $start = $start + 1 ; } elsif ($mess =~ /ERR/) { print "" ; $start = $start + 1 ; } elsif ($mess =~ /Priority: 4/) { print "" ; $start = $start + 1 ; } elsif ($mess =~ /Priority: 6/) { print "" ; $start = $start + 1 ; } elsif ($mess =~ /Priority: 10/) { print "" ; $start = $start + 1 ; } elsif ( ($Searchyes) && ($mess =~/$Search/) ) { print "" ; $start = $start + 1 ; } else { print "" ; $start = $start + 1 ; } if ($count == $start) { print "

DATE	TIME	FACILITY	SENSOR	MESSAGE
$date	$t	$f	$h	$mess
$mess
$mess
$mess
$mess
$mess
$mess

" ; close R ; exit 1; } ; } print "" ; close R ;