checkpoint fw logging explained?

[alex7577]

All, I'm trying to find some good documentation on the inner working of fw log data. I am very familiar with the fw log syntax and commnds. But I have questions about the ptr files and such.

I can't seem find any good documentation on a summary of this.

I checked this site out:

http://www.tornado.se/slac/fw1repexplained.html

And I really like how the data is displayed. I'm sure some kind of script (PERL?) would extract this data by piping firewall log files via fw log command.

Anyone got any good resources for this?

[chillyjim]

Check out the OPSEC SDK http://www.opsec.com/opsecdownload.html

Everything you want to know about writing a LEA should be in there.