cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

211
Views
0
Helpful
3
Replies
Highlighted
Beginner

email administrators when inspect rules are violated

I have a Pix515 and was wondering if there is an easy way to email administratos when an inspect rule is violated. For example one of my ESMTP rules was violated and the following was logged in syslog:

%PIX-4-108004: ESMTP Classification: Dropped connection for ESMTP Request from outside:208.65.144.247/31095 to inside:mail.ddi.org_INSIDE/25; matched Class 4: header line length gt 998

It is an easy fix, but is there an easier way to be notified without looking in syslog or manually setting up for each case that I want to be notified for? Can the pix email me if one of the inspect rules denies traffic?

3 REPLIES 3
Highlighted
Rising star

Not that I know of. You could setup SNMP on the PIX and relay all messages to a logging server and use SNMP traps to gather the messages you want then generate e-mails based on that.

Highlighted

This is very simple. Write a simple Perl script with regex experession and watch the syslog message for what you want to see. Put in a condition that if the script sees it, it send you an email. The script can be written 5 minutes.

Highlighted
Content for Community-Ad