seach in log file archive by using findevent

fisherman_ironport · ‎03-25-2009

Hi @all,
we are using several IronPort C series systems. All our log files are stored via scp on a central log file server running under Linux. The log files are stored in subfolders for each system.

Now it became to be necessary to search emails from last year. I did it by using the grep command and it was very complicated to find all informations (MID, ICID, DCID).

Does someone knows a way to use the findevent command on a Linux based system or do someone have a normal shell script which do the same work as the findevent command do?

Regards, Thomas

kluu_ironport · ‎03-25-2009

There is a tool on the Support Portal that emulates the AsyncOS's findevent command. The tool was written in Python which should work on your Linux system, assuming that Python is available on it.

Find Event Tool

Python

This is the core code to the CLI findevent command which will dump log information based on MID or regular expression searches on "To", "From" and "Subject". The help command description for findevent is "Find events in mail log files".

1. Log onto the support portal (http://www.ironport.com/support/login.html).
2. After you log in, click on "Appliance Documentation > Tools" on the left side and go down near the bottom of the page.

good luck

kluu_ironport · ‎03-25-2009

How to get it working.

1. Load the python script into the /tmp directory

2. Verify the path to your Python code

bash> whereis python
python: /usr/bin/python /usr/bin/python2.4 /usr/lib/python2.4 /usr/share/man/man1/python.1.gz

3. Update the /tmp/findevent.py script with the path to Python

4. Make the script executable

chmod a+x /tmp/findevent.py

5.

/tmp/findevent.py -h
./findevent.py [-i] -F file [-f FROM | -m MID | -s SUBJECT -t TO]

Note:
- Only the last -f, -m, -s, or -t will be used.
- Multiple -F arguments can be specified but should be date
ordered to give consistent results.

fisherman_ironport · ‎03-25-2009

Hi kluu,
many thanks for that.
Sounds good and I think that will work. I'll try it asap.

steven_geerts · ‎03-31-2009

HI!

Has anyone of you done some porting to a syslog based log storage?

We use syslogNG to collect the output of our C series on a Linux system and I would love to have findevent operational on the centralized log server.
At the moment that's not possible because the trailing columns you have with syslog are not accepted by the Python script...

All advises are welcome!

Steven