WELF2DLF.IN(1)

💅 welf2dlf — the manual page, but make it cute

okay so bestie, this is WELF2DLF.IN(1) from LogReport's Lire Documentation, and it's literally about converting firewall logs. stay with me, it's gonna slay 🎀

---

✨ NAME ✨

welf2dlf — converts firewall logs that are in WebTrends Enhanced Log Format into DLF. that's it, that's the whole vibe 💖

✨ SYNOPSIS ✨

welf2dlf file

one file, one job, iconic behavior honestly.

✨ DESCRIPTION ✨

so welf2dlf takes your firewall logs in the WebTrends Enhanced Log Format and converts them into the firewall DLF. glow-up complete ✨

that format is defined at this URL, keep it, don't lose it:

http://www.netiq.com/partners/technology/welf.asp

this converter also supports the SonicWall extensions — yes, extra credit, we love to see it 🫶

and if you wanna know which firewall products actually support that format, the list lives here:

http://www.netiq.com/products/fwr/compatible.asp

✨ IMPLEMENTATION NOTES ✨

okay, real talk time, because this is where the details matter 👑

since the firewall DLF only supports packet filters, not all records will be mapped to DLF. like, not every record makes the cut, no cap.

Dropped packets messages — the ones with a field msg="XXX packet dropped" — get mapped to a denied DLF packet. and yes, that includes all the msg="TCP connection dropped" records too. those packets will have a length of 0, and that's not us being lazy, that's literally a limitation of the format, which doesn't log that info on dropped packets 💀

Messages with a proto= field set get interpreted as "permitted" "packet". and ngl, that's not exactly "right", because that message really represents a "packets flow" and not a single packet. we're doing our best here 🙈

Other records will be ignored. bye bestie 👋

💡 you may use the welf_proxy service in the proxy superservice to extract proxy level information from WELF logs. handy, right? 🦋

✨ EXAMPLES ✨

wanna process a log as produced by WebTrends? bet:

$ welf2dlf < welf.log

but fr fr, welf2dlf will be rarely used on its own — it's way more likely to be called by lr_log2report:

$ lr_log2report welf < /var/log/welf.log

✨ THANKS ✨

huge shoutout to Mark D. Nagel, for giving feedback and supplying patches 🫶 you ate.

✨ SEE ALSO ✨

• Lire::WELF(3)
• welf_proxy2dlf(1)

go read those too, iykyk 📚

✨ AUTHORS ✨

Francis J. Lacoste <flacoste@logreport.org> — legend behavior 👑

✨ VERSION ✨

$Id: welf2dlf.in,v 1.14 2006/07/23 13:16:35 vanbaal Exp $

✨ COPYRIGHT ✨

Copyright (C) 2001 Stichting LogReport Foundation LogReport@LogReport.org

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program (see COPYING); if not, check with

http://www.gnu.org/copyleft/gpl.html

---

and that's a wrap, bestie 💅✨ this was Lire 2.1.1, dated 2025-09-28, page WELF2DLF.IN(1) — go forth and convert those logs, you gorgeous packet-filtering icon 🎀💖