PIX2DLF.IN(1)

📦 version 2.1.1, in arch rolling

💅 pix2dlf — like, the whole vibe

okay so bestie, welcome to PIX2DLF.IN(1), straight out of LogReport's Lire Documentation. this is the glow-up guide to pix2dlf, and yes it's giving very much "niche utility that eats". let's go 🎀

✨ NAME ✨

pix2dlf — converts PIX logs into the firewall DLF format. that's it, that's the serve 💖

🦋 SYNOPSIS 🦋

pix2dlf

no flags. no options. no little extras. just vibes and stdin ✨

🌸 DESCRIPTION 🌸

okay so picture this: this script is sitting there waiting for syslog-type logs from a Cisco PIX firewall to come in on stdin. and here's the thing — you should be logging messages with severity level informational (6) and up, mmkay? those messages look like this, literally:

 Jan 15 12:58:37 pix1 %PIX-4-106543: Deny tcp src outside:1.2.3.4/1234 dst
  inside:2.3.4.5/80 by access-group "foo"
 Jan 16 10:37:09 pix1 %PIX-4-106543: Deny udp src outside:3.4.5.6/137 dst
  inside:4.5.6.7/137 by access-group "foo"
 Jan 17 08:43:46 pix1 %PIX-4-106543: Deny icmp src outside:5.6.7.8 dst
  inside:6.7.8.9 (type 8, code 0) by access-group "foo"
 Jan 24 00:07:39 pix1 %PIX-6-302000: Teardown TCP connection 178359 faddr
  7.8.9.10/102 gaddr 8.9.10.11/21652 laddr 9.10.11.12/4107 duration
  0:00:01 bytes 755 (TCP FINs)
 Jan 24 00:07:45 pix1 %PIX-6-302000: Teardown UDP connection for faddr
  10.11.12.13/711 gaddr 11.12.13.14/1259 laddr 12.13.14.15/1259

so basically the shape of it is, like:

syslog_time_stamp log_host %PIX-Level-Message_number: Message_text

see also (the receipts, if you will 🧾): http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/syslog/pixemint.htm#xtocid11 .

it'll spit out DLF records — in the Lire firewall DLF format — on STDOUT. slay.

now, for right now, only these messages actually get used. like, only these ones. no cap:

%PIX-2-106001
%PIX-2-106002
%PIX-2-106006
%PIX-2-106007
%PIX-3-106010
%PIX-3-106014
%PIX-6-106015
%PIX-1-106021
%PIX-4-106023
%PIX-6-302002
%PIX-6-302006
%PIX-6-302014
%PIX-6-302016

and a lil' reminder about the severity levels so nobody gets confused: level 1 is alert, 6 is informational. (and just so you have the whole map — 0 is emergency, 7 is debugging.) 🫶

🎀 EXAMPLES 🎀

processing a log that a Cisco PIX produced? iconic, do this:

$ pix2dlf < pix.log

ngl, pix2dlf being run all on its own is gonna be rare — the main character here is really lr_log2report:

$ lr_log2report pix < /var/log/pix.log

💀 BUGS 💀

okay let's be real for a sec 🙈:

  • this script hasn't yet been tested by a very wide range of log files, so it's not mature yet. it's still growing, give it time.
  • nobody has studied the Cisco documentation to check for changes in the log file format — like, for example, between PIX Firewall Version 4.0 and 6.2. that has not been done yet.
  • we probably do not support any of the PIX products really fully. we found documentation for log files for PIX version 4.3, 4.4, 5.0, 5.1, 5.2, 5.3, 6.0, 6.1 and 6.2, but we didn't implement all the peculiarities found in those docs yet. this script strives to support PIX 6.2 in most common cases — that's the goal, bestie.
  • and if you're hacking on this script: beware ⚠️ the log syntax has changed during PIX development. also note that some rudimentary state is represented in PIX logs — and that state is not used yet in this script.

🔥 SEE ALSO 🔥

⭐ VERSION ⭐

$Id: pix2dlf.in,v 1.26 2009/03/15 08:10:55 vanbaal Exp $

Copyright (C) 2002 Stichting LogReport Foundation <logreport@logreport.org>

this file is part of Lire. 💜

Lire is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License for more details. 😭

you should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with http://www.gnu.org/copyleft/gpl.html.

fr fr, all that legal text matters — it's not just filler, bestie. 🫶

🌈 THANKS 🌈

big shoutout to Roberto dal Zilio and Ketil Adolfsen, for supplying PIX logs for debugging — absolute legends 🧚. and Anthony (acquant) for fixing bugs. we stan 🎀

🍓 AUTHOR 🍓

initial version by Wessel Dankers <wsl@logreport.org>, based upon Lire's cisco_acl2dlf script. lots of later changes by Joost van Baal <joostvb@logreport.org>.

and that's the whole page, bestie — brought to you by Lire 2.1.1, dated 2025-09-28. periodt. 💅✨

📦 where this page comes from