--- name: "fwctlreport" section: "1p" platform: "linux" package: "fwctl" version: "0.28-2" release: "Debian 3.0 (Woody)" platforms: ["linux"] url: "https://new.carta.tech/fwctlreport" --- # fwctlreport(1p) Generates text reports from fwctllog output. ## NAME fwctlreport - Generates text reports from fwctllog output. ## SYNOPSIS fwctlreport \[--start report\_start\]\ \[--end report\_end ⎪ --period report\_period \]\ \[--threshold cutoff\_threshold\] \[--limit expression\]\ \[--nohostname\]\ \[--report report ...\]\ logfile ... fwctlreport --help ## DESCRIPTION **fwctlreport** can be use to generates several kind of reports from the kernel packet filters logs once processed by **fwctllog**. ## INPUT OPTIONS The records on which the report will be generated can be customized with the following options.\ - start Sets the start of the report's period. If the *Date::Manip*(3) module is installed, you can use any format that this module can parse. If that module is'nt installed you must use the following format YYYY-MM-DD HH:MM:SS or any meaningful subset of that format. If this option is not used, the report will start with the first record.\ - end Sets the end of the report's period. If the *Date::Manip*(3) module is installed, you can use any format that this module can parse. If that module is'nt installed you must use the following format YYYY-MM-DD HH:MM:SS or any meaningful subset of that format. If this option is not used, the report will end with the last record.\ - period Sets the length of the report's period. This length is interpreted relative to the report's start. This option has priority over the **end** option. If you have the Date::Manip module installed, you can use any format that this module can parse. If that module isn't available, you can use a subset of the following format X weeks X days X hours X mins X secs.\ - threshold This option will removed records identical in protocol, destination ports, source addresses and destination addressesses that appears in the time window specified by the threshold parameters. Defaults is 120 (2 minutes). Use 0 to generates reports for all the packets.\ - limit This parameter can be used to restrict the records over which the report is generated. It is an expression which will be used to select a subset of all the records. You can use the following fields : src\_ip, dst\_ip, src\_host, dst\_host, action, device, src\_port, dst\_port, src\_serv, dst\_serv, proto, proto\_name, and the following operator =, !=, \<, \>, \<=, \>=, /regex/, /regex/i. Those operators have the same meaning as in perl. You can also use parentheses and the following logic operator : or, and, not . - hostname or nohostname If you usee nohostname, only the IP address will appear in the report, even if the hostname is available.\ - report You can use this option to specify the reports that will be generated. By default, the *details* report is generated. ## REPORT Here are the reports that can be generated : - service\_sum Report that shows the number of log entry for each services.\ - service Report that shows the time, action and source host logged for each services.\ - service\_host\_sum Report that shows the number of log entry for each destination host / service.\ - service\_host Report that shows the time, action and source host logged for each destination host / service.\ - service\_alias\_sum Report that shows the number of log entry for each destination alias / service.\ - service\_alias Report that shows the time, action and source host logged for each destination alias / service.\ - dst\_alias\_sum Report that shows the number of log entry for each destination alias.\ - dst\_alias Report that shows the time, action, source host and service logged for each destination alias.\ - dst\_host\_sum Report that shows the number of log entry for each destination host.\ - dst\_host Report that shows the time, action, source host and service logged for each destination host.\ - src\_alias\_sum Report that shows the number of log entry for each source alias.\ - src\_alias Report that shows the time, action, destination host and service logged for each source alias.\ - src\_host\_sum Report that shows the number of log entry for each source host.\ - src\_host Report that shows the time, action, destination host and service logged for each source host.\ - details Reports that shows all the information associated with each log entry. ## AUTHOR Francis J. Lacoste \ ## COPYRIGHT Copyright (c) 2000 iNsu Innovations Inc. All rights reserved. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, you can get one at http://www.gnu.org/copyleft/gpl.html ## SEE ALSO *Fwctl*(3) *Fwctl::RuleSet*(3) *fwctl*(8) *fwctllog*(8) *Fwctl::Report*(3).