Skip to content

Instantly share code, notes, and snippets.

@joe-at-cp
Last active January 14, 2022 17:51
Show Gist options
  • Select an option

  • Save joe-at-cp/46904f8088bf6d458b4893eed9814e97 to your computer and use it in GitHub Desktop.

Select an option

Save joe-at-cp/46904f8088bf6d458b4893eed9814e97 to your computer and use it in GitHub Desktop.
Check Point Management API Log Parser v1
#!/bin/bash
#api.elg log parser v1
#Joe Dillig - Check Point Software 2019
API_HEADER_IDs=$(cat api.elg | grep ID | awk '{print $2}' | sort -n | uniq)
for ID in $API_HEADER_IDs
do
#API Event Data (Request and Reply)
API_EVENT=$(cat api.elg | sed -n -e "/ID: $ID/,/--------------------------------------/ p;")
#Parse Request Details (For speed, comment out when not used)
CLIENT=$(echo $API_EVENT | sed -n -e 's/^.*X-Forwarded-For=//p' | cut -d ',' -f1 | tr -d [])
SESSION_ID=$(echo $API_EVENT | sed -n -e 's/^.*x-chkp-sid=//p' | cut -d ',' -f1 | tr -d []) #Capital X or no?
USER_AGENT=$(echo $API_EVENT | sed -n -e 's/^.*User-Agent=//p' | cut -d ',' -f1 | tr -d [])
#Get CSV Log Data
CSV_LOG=$(cat api.elg | sed -n -e "/ID: $ID/,/ID: $ID/ p;" | grep writeCsvLine | head -1 | cut -d ']' -f2 | cut -c 4-)
#Only display data when api session data is available
if [ $SESSION_ID ]; then
#Get client username from cpm.elg
API_USER=$(cat cpm.elg | grep coresvc.internal.LoginSvcImpl | grep "client session token" | grep $SESSION_ID | awk '{print $7}')
#Simple CSV
echo $CSV_LOG,$CLIENT,$API_USER,$SESSION_ID,$USER_AGENT,$ID
#Pretty Columns
#echo $CSV_LOG,$CLIENT,$SESSION_ID,$COMMAND,$USER_AGENT,$ID | column -t -s ','
fi
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment