#########################################################################

# $Id$

##########################################################################

# $Log: sonicwall,v $

# Revision 1.4  2008/06/30 23:07:51  kirk

# fixed copyright holders for files where I know who they should be

#

# Revision 1.3  2008/03/24 23:31:27  kirk

# added copyright/license notice to each script

#

# Revision 1.2  2006/10/18 17:57:49  mike

# Updates from Laurent DuFour -mgt

#

# Revision 1.1  2005/05/04 15:54:23  bjorn

# Sonicwall submitted by Laurent Dufour

#

##########################################################################

########################################################

# This was written and is maintained by:

#    Laurent DUFOUR <laurent.dufour@havas.com>,<dufour_l@hotmail.com>

#    based on the work of

#    Kirk Bauer <kirk@kaybee.org>

#

# Please send all comments, suggestions, bug reports,

#    etc, to logwatch-devel@lists.sourceforge.net

########################################################

#######################################################

## Copyright (c) 2008 Laurent DUFOUR

## Covered under the included MIT/X-Consortium License:

##    http://www.opensource.org/licenses/mit-license.php

## All modifications and contributions by other persons to

## this script are assumed to have been donated to the

## Logwatch project and thus assume the above copyright

## and licensing terms.  If you want to make contributions

## under your own copyright or a different license this

## must be explicitly stated in the contribution an the

## Logwatch project reserves the right to not accept such

## contributions.  If you have made significant

## contributions to this script and want to claim

## copyright please contact logwatch-devel@lists.sourceforge.net.

#########################################################

use Logwatch ':all';

my $Debug = $ENV{'LOGWATCH_DEBUG'} || 0;

my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;

my %configConvert = (

    'human-readable'    => 0,

    'Human-readable'    => 1,

    'truncate-readable' => 2,

  );

# Taken from DiskUsage.pm inside Filesys-DiskUsage-0.02

#

# Jose Castro, C<< <cog@cpan.org>

# Please report any bugs or feature requests to

# C<bug-disk-usage@rt.cpan.org>, or through the web interface at

# L<http://rt.cpan.org>.  I will be notified, and then you'll

# automatically be notified of progress on your bug as I make changes.

#

# Copyright 2004 Jose Castro, All Rights Reserved.

#

#This program is free software; you can redistribute it and/or modify it

#under the same terms as Perl itself.

#

#

# convert size to human readable format

sub _convert {

  defined (my $size = shift) || return undef;

  my $config = {@_};

#  $config->{human} || return $size;

  my $block = $config->{'Human-readable'} ? 1000 : 1024;

  my @args = qw/B K M G/;

  while (@args && $size > $block) {

    shift @args;

    $size /= $block;

  }

  if ($config->{'truncate-readable'} > 0) {

    $size = sprintf("%.$config->{'truncate-readable'}f",$size);

  }

  return "$size$args[0]";

}

if ( $Debug >= 5 ) {

    print STDERR "\n\nDEBUG: Inside SONICWALL Filter \n\n";

    $DebugCounter = 1;

}

my ($month,$day,$time,$host_ip,$host,$conn,$msg,$message);

while (defined($ThisLine = <STDIN>)) {

    if ( $Debug >= 30 ) {

	print STDERR "DEBUG($DebugCounter): $ThisLine";

	$DebugCounter++;

    }

($month,$day,$time,$host_ip,$host_id,$host_sn,$msg)=split(/ +/,$ThisLine,7);

if ($ThisLine =~ /sn=/ ) { #mean that we ave to deal with a sonicwall log file line

   if ( ($ThisLine =~ /traffic/ ) or

         ($ThisLine =~ /Copyright/ ) or

         ($ThisLine =~ /removed due to simultaneous rekey/ ) or

         ($ThisLine =~ /Administrator logged out/ ) or

         ($ThisLine =~ /Connection (Closed|Opened)/ ) or

         ($ThisLine =~ /(TCP|UDP) connection dropped/ )

    ) {

      # don't care about this, will code this later

   }

    elsif ( ($number,$src_ip,$port_src,$interface_src,$src_name,$dst_ip,$port_dst,$interface_dst,$dst_name,$pad) = ($ThisLine =~ /msg="UDP packet dropped" n=(\d+) src=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? dst=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? (.*)?/) ) {

      $UDP_dropped{$host_ip}{LookupIP($src_ip)," to ",LookupIP($dst_ip)}++

   }

    elsif ( ($number,$src_ip,$port_src,$interface_src,$src_name,$dst_ip,$port_dst,$interface_dst,$dst_name,$pad) = ($ThisLine =~ /msg="TCP packet dropped" n=(\d+) src=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? dst=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? (.*)?/) ) {

      $TCP_dropped{$host_ip}{LookupIP($src_ip)," to ",LookupIP($dst_ip)}++

   }

    elsif ( ($number,$src_ip,$port_src,$interface_src,$src_name,$dst_ip,$port_dst,$interface_dst,$dst_name,$pad) = ($ThisLine =~ /msg="ICMP packet dropped" n=(\d+) src=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? dst=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? (.*)?/) ) {

      $ICMP_dropped{$host_ip}{LookupIP($src_ip)," to ",LookupIP($dst_ip)}++

   }

    elsif ( ($number,$src_ip,$port_src,$interface_src,$src_name,$dst_ip,$port_dst,$interface_dst,$dst_name,$ip_proto,$xfer_port_type,$op_type,$http_result) = ($ThisLine =~ /n=(\d+) src=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? dst=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? proto=(udp|tcp)\/(http|80) op=(HEAD|Other) result=(\d+)/) ) {

 	if ($op_type eq "HEAD") {

	$URL_HEAD{$host_ip}{$url}++;

	}

	else {

	$URL_OTHER{$host_ip}{$url}++;

	}

}

    elsif ( ($number,$src_ip,$port_src,$interface_src,$src_name,$dst_ip,$port_dst,$interface_dst,$dst_name,$ip_proto,$xfer_port_type,$op_type,$xfer_way,$xfer_byte,$http_result,$url,$args) = ($ThisLine =~ /n=(\d+) src=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? dst=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? proto=(udp|tcp|icmp)\/(http|80) op=(GET|POST) (rcvd|sent)=(\d+) result=(\d+) dstname=(.*) arg=(.*)(.*)/) ) {

	if ($op_type eq "GET") {

	$URL_GET{$host_ip}{$url}++;

	}

	else {

	$URL_POST{$host_ip}{$url}++;

	}

      if ($xfer_way eq "sent")	{

        $ProtoPacketSent{$host_ip}{$ip_proto}++;

	$TotalProtoByteSent{$host_ip}{$ip_proto}=$TotalProtoByteSent{$host_ip}{$ip_proto}+$xfer_byte;

        if (($ip_proto eq "tcp") or ($ip_proto eq "udp")) {

        $ByteSent{$host_ip}{$ip_proto,"/",$xfer_port_type}=$ByteSent{$ip_proto}{$ip_proto,"/",$xfer_port_type}+$xfer_byte;

 	$PortPacketSent{$host_ip}{$ip_proto,"/",$xfer_port_type}++;

	}

     }

 else {

        $ProtoPacketReceived{$host_ip}{$ip_proto}++;

	$TotalProtoByteReceived{$host_ip}{$ip_proto}=$TotalProtoByteReceived{$host_ip}{$ip_proto}+$xfer_byte;

        if (($ip_proto eq "tcp") or ($ip_proto eq "udp")) {

	 $ByteReceived{$host_ip}{$ip_proto,"/",$xfer_port_type}=$ByteReceived{$ip_proto}{$ip_proto,"/",$xfer_port_type}+$xfer_byte;

	 $PortPacketReceived{$host_ip}{$ip_proto,"/",$xfer_port_type}++;

	}

   }

}

    elsif ( ($number,$src_ip,$port_src,$interface_src,$src_name,$dst_ip,$port_dst,$interface_dst,$dst_name,$ip_proto,$xfer_port_type,$op_type,$xfer_byte_sent,$xfer_byte_rcvd,$http_result,$url,$args) = ($ThisLine =~ /n=(\d+) src=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? dst=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? proto=(udp|tcp|icmp)\/(http|80) op=(GET|POST) sent=(\d+) rcvd=(\d+) result=(\d+) dstname=(.*) (arg=(.*))?/) ) {

	if ($op_type eq "GET") {

	$URL_GET{$host_ip}{$url}++;

	}

	else {

	$URL_POST{$host_ip}{$url}++;

	}

        $ProtoPacketSent{$host_ip}{$ip_proto}++;

	$TotalProtoByteSent{$host_ip}{$ip_proto}=$TotalProtoByteSent{$host_ip}{$ip_proto}+$xfer_byte_sent;

        if (($ip_proto eq "tcp") or ($ip_proto eq "udp")) {

        $ByteSent{$host_ip}{$ip_proto,"/",$xfer_port_type}=$ByteSent{$ip_proto}{$ip_proto,"/",$xfer_port_type}+$xfer_byte_sent;

 	$PortPacketSent{$host_ip}{$ip_proto,"/",$xfer_port_type}++;

	}

	$ProtoPacketReceived{$host_ip}{$ip_proto}++;

	$TotalProtoByteReceived{$host_ip}{$ip_proto}=$TotalProtoByteReceived{$host_ip}{$ip_proto}+$xfer_byte_rcvd;

        if (($ip_proto eq "tcp") or ($ip_proto eq "udp")) {

	 $ByteReceived{$host_ip}{$ip_proto,"/",$xfer_port_type}=$ByteReceived{$ip_proto}{$ip_proto,"/",$xfer_port_type}+$xfer_byte_rcvd;

	 $PortPacketReceived{$host_ip}{$ip_proto,"/",$xfer_port_type}++;

	}

}

    elsif ( ($number,$src_ip,$port_src,$interface_src,$src_name,$dst_ip,$port_dst,$interface_dst,$dst_name,$ip_proto,$xfer_port_type,$xfer_way,$xfer_byte) = ($ThisLine =~ /n=(\d+) src=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? dst=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? proto=(udp|tcp|icmp)\/(.*) (rcvd|sent)=(\d+)(.*)/) ) {

      if ($xfer_way eq "sent")	{

        $ProtoPacketSent{$host_ip}{$ip_proto}++;

	$TotalProtoByteSent{$host_ip}{$ip_proto}=$TotalProtoByteSent{$host_ip}{$ip_proto}+$xfer_byte;

        if (($ip_proto eq "tcp") or ($ip_proto eq "udp")) {

        $ByteSent{$host_ip}{$ip_proto,"/",$xfer_port_type}=$ByteSent{$ip_proto}{$ip_proto,"/",$xfer_port_type}+$xfer_byte;

 	$PortPacketSent{$host_ip}{$ip_proto,"/",$xfer_port_type}++;

	}

     }

 else {

        $ProtoPacketReceived{$host_ip}{$ip_proto}++;

	$TotalProtoByteReceived{$host_ip}{$ip_proto}=$TotalProtoByteReceived{$host_ip}{$ip_proto}+$xfer_byte;

        if (($ip_proto eq "tcp") or ($ip_proto eq "udp")) {

	 $ByteReceived{$host_ip}{$ip_proto,"/",$xfer_port_type}=$ByteReceived{$ip_proto}{$ip_proto,"/",$xfer_port_type}+$xfer_byte;

	 $PortPacketReceived{$host_ip}{$ip_proto,"/",$xfer_port_type}++;

	}

   }

}

#time="2005-03-23 09:03:27" fw=62.2.84.91 pri=5 c=128 m=37 msg="UDP packet dropped" n=3759 src=64.74.133.26:11379:WAN dst=62.2.84.91:33436:WAN^M

#Mar 23 12:45:32 10.15.30.1 id=firewall sn=004010144097 time="2005-03-23 11:08:20" fw=62.2.84.91 pri=6 c=1024 m=98 n=61505 src=195.143.213.210:4992:WAN dst=62.2.84.92:1802:DMZ proto=tcp/1802 rcvd=106 ^M

    elsif ( ($dst_ip,$msg) = ($ThisLine =~ /System Config saved from host (\d+\.\d+\.\d+\.\d+) (.*)/) ) {

      $SysCfgSaved{$host_ip}{LookupIP($dst_ip)}++;

   }

   elsif ( ($dst_ip,$msg) = ($ThisLine =~ /The system configuration was saved from host (\d+\.\d+\.\d+\.\d+) by (.*)/) ) {

      $SysCfgSaved{$host_ip}{LookupIP($dst_ip)}++;

   }

   elsif ( ($ThisLine =~ /Compiled/) ) {

      $Started{$host_ip}++;

   }

   elsif ( ($ThisLine =~ /DNS entries have been automatically refreshed./) ) {

      $DNSRefreshed{$host_ip}++;

   }

   elsif ( ($ThisLine =~ /DNS has been refreshed./) ) {

      $DNSRefreshed{$host_ip}++;

   }

   elsif ( ($ThisLine =~ /Log successfully sent via email/) ) {

      $SyslogHost{$host_ip}{$host_ip}++;

   }

   elsif ( ($ThisLine =~ /Syslog facility has been changed/) ) {

      $SyslogFacility{$host_ip}++;

   }

   elsif ( ($ThisLine =~ /Syslog security facility has been changed/) ) {

      $SyslogFacility{$host_ip}++;

   }

   elsif ( ($ThisLine =~ /The system clock has been updated through NTP./) ) {

      $NTPUpdated{$host_ip}++;

   }

   elsif ( ($ThisLine =~ /failed to get clock through NTP/) ) {

      $NTPFailed{$host_ip}++;

   }

   elsif ( ($ThisLine =~ /Access Rule added/) ) {

      $AccessRuleAdded{$host_ip}++;

   }

   elsif ( ($message) = ($ThisLine =~ /RELOAD: (.*)/) ) {

      $ReloadRequested{$host_ip}{$message}++;

   }

   elsif ( ($message) = ($ThisLine =~ /RESTART: (.*)/) ) {

      $Restarted{$host_ip}{$message}++;

   }

   elsif ( $ThisLine =~ m/msg="Probable TCP NULL scan " n=(\d+) src=(\d+\.\d+\.\d+\.\d+) (.*)/ ) {

       if ( $Debug >= 5 ) {

	   print STDERR "DEBUG: Found -TCP NULL scan- line\n";

       }

       my $name = LookupIP($2);

       $Temp = "TCP NULL scan from $name";

       $TCP_NULL_scan{$host_ip}{$Temp}++;

   }

   elsif ( ($interface) = ($ThisLine =~ /msg="Successful administrator login" n=(\d+) src=(\d+\.\d+\.\d+\.\d+) (.*)/) ) {

       if ($Debug >= 5) {

	   print STDERR "DEBUG: Found -$1 logged in from $4 using $2\n";

       }

       if ($Detail >= 20) {

	   $Users{$host_ip}{"from ",$2}{"using port 80"}{$1}++;

       } else {

	   $Users{$host_ip}{"from ",$2}{"using port 80"}{"(all)"}++;

       }

   }

   elsif ( ($interface) = ($ThisLine =~ /msg="(WAN zone administrator login allowed|Web management request allowed)" n=(\d+) usr=(\w+) src=(\d+\.\d+\.\d+\.\d+)(.*)?/) ) {

       if ($Debug >= 5) {

	   print STDERR "DEBUG: Found -$1 logged in from $5 using $3\n";

       }

       if ($Detail >= 20) {

	   $Users{$host_ip}{"from ",$3}{"using port 80"}{$1}++;

       } else {

	   $Users{$host_ip}{"from ",$3}{"using port 80"}{"(all)"}++;

       }

   }

   elsif ( $ThisLine =~ m/msg="Administrator login failed - incorrect password" n=(\d+) src=(\d+\.\d+\.\d+\.\d+) (.*)/ ) {

       if ( $Debug >= 5 ) {

	   print STDERR "DEBUG: Found -Failed login- line\n";

       }

       my $name = LookupIP($2);

       $Temp = "HTTP from $name";

       $BadAdminLogins{$host_ip}{"Administrator login failed - incorrect password from $name"}++;

       $IllegalUsers{$host_ip}{$Temp}++;

   }

   elsif ( $ThisLine =~ m/msg="Unknown user attempted to log in" n=(\d+) src=(\d+\.\d+\.\d+\.\d+) dst=(\d+\.\d+\.\d+\.\d+) user=(.*)/ ) {

       if ( $Debug >= 5 ) {

	   print STDERR "DEBUG: Found -Failed login- line\n";

       }

       my $name = LookupIP($2);

       $Temp = "HTTP from $name";

       $BadLogins{$host_ip}{"$4 user attempted to log in from $name"}++;

       $IllegalUsers{$host_ip}{$Temp}++;

   }

   elsif ( $ThisLine =~ m/SSH client at (.+) has attempted to make an SCS connection to interface untrust with IP (.+) but failed (.*)/ ) {

       my $name = LookupIP($2);

       $Temp = "SSH from $name";

       $BadLogins{$host_ip}{$Temp}++;

       $IllegalUsers{$host_ip}{$Temp}++;

   }

    elsif ( ($Msg,$number,$src_ip,$port_src,$interface_src,$src_name,$dst_ip,$port_dst,$interface_dst,$dst_name,$pad) = ($ThisLine =~ /msg="(.*)" n=(\d+) src=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? dst=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)?(S+)?(.*)?/) ) {

      $Msg{$host_ip}{$Msg," for ",LookupIP($src_ip)," to ",LookupIP($dst_ip)}++

   }

    elsif ( ($Msg,$number,$src_ip,$port_src,$interface_src,$src_name,$dst_ip,$port_dst,$interface_dst,$dst_name,$pad) = ($ThisLine =~ /msg="(Ping of death dropped|Smurf Amplification attack dropped)" n=(\d+) src=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)? dst=(\d+\.\d+\.\d+\.\d+):(\d+):(WAN|LAN|DMZ):?(.*)?/) ) {

      $Msg{$host_ip}{$Msg," for ",LookupIP($src_ip)," to ",LookupIP($dst_ip)}++

   }

else {

      # Report any unmatched entries...

      push @OtherList,$ThisLine;

   }

}

} #end of mean we have a sonic wall logfile line

if (keys %Started) {

   print "\nDevice started :\n";

   foreach $ThisOne (keys %Started) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$Started{$ThisOne}}) {

         print "\t Started" .$ThatOne . "\t: " . $Started{$ThisOne}{$ThatOne} . "{ Time(s)\n";

      }

   }

}

if (keys %UDP_dropped) {

   print "\nDevice where ip UDP packets have been dropped  :\n";

   foreach $ThisOne (keys %UDP_dropped) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$UDP_dropped{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $UDP_dropped{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %TCP_dropped) {

   print "\nDevice where ip TCP packets have been dropped  :\n";

   foreach $ThisOne (keys %TCP_dropped) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$TCP_dropped{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $TCP_dropped{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %ICMP_dropped) {

   print "\nDevice where ip ICMP packets have been dropped  :\n";

   foreach $ThisOne (keys %ICMP_dropped) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$ICMP_dropped{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $ICMP_dropped{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %Msg) {

   print "\nDevice others message  :\n";

   foreach $ThisOne (keys %Msg) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$Msg{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $Msg{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %URL_GET) ) {

   print "\nDevice URL GET :\n";

   foreach $ThisOne (keys %URL_GET) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$URL_GET{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $URL_GET{$ThisOne}{$ThatOne} . " times(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %URL_POST) ) {

   print "\nDevice URL POST :\n";

   foreach $ThisOne (keys %URL_POST) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$URL_POST{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $URL_POST{$ThisOne}{$ThatOne} . " times(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %URL_HEAD) ) {

   print "\nDevice URL HEAD :\n";

   foreach $ThisOne (keys %URL_HEAD) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$URL_HEAD{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $URL_HEAD{$ThisOne}{$ThatOne} . " times(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %URL_OTHER) ) {

   print "\nDevice URL OTHER :\n";

   foreach $ThisOne (keys %URL_OTHER) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$URL_OTHER{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $URL_OTHER{$ThisOne}{$ThatOne} . " times(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %ProtoPacketReceived) ) {

   print "\nDevice Total packets received by protocols :\n";

   foreach $ThisOne (keys %ProtoPacketReceived) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$ProtoPacketReceived{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $ProtoPacketReceived{$ThisOne}{$ThatOne} . " packet(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %PortPacketReceived) ) {

   print "\nDevice Total packets received by ports :\n";

   foreach $ThisOne (keys %PortPacketReceived) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$PortPacketReceived{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $PortPacketReceived{$ThisOne}{$ThatOne} . " packet(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %TotalProtoByteReceived) ) {

   print "\nDevice Total Bytes received by protocols :\n";

   foreach $ThisOne (keys %TotalProtoByteReceived) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$TotalProtoByteReceived{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . _convert($TotalProtoByteReceived{$ThisOne}{$ThatOne}, %configConvert ) . " Byte(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %ByteReceived) ) {

   print "\nDevice Total Bytes received by ports :\n";

   foreach $ThisOne (keys %ByteReceived) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$ByteReceived{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " .  _convert($ByteReceived{$ThisOne}{$ThatOne}, %configConvert ) . " Byte(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %ProtoPacketSent) ) {

   print "\nDevice Total packets sent by protocols :\n";

   foreach $ThisOne (keys %ProtoPacketSent) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$ProtoPacketSent{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $ProtoPacketSent{$ThisOne}{$ThatOne} . " packet(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %PortPacketSent) ) {

   print "\nDevice Total packets sent by ports :\n";

   foreach $ThisOne (keys %PortPacketSent) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$PortPacketSent{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $PortPacketSent{$ThisOne}{$ThatOne} . " packet(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %TotalProtoByteSent) ) {

   print "\nDevice Total Bytes sent by protocols :\n";

   foreach $ThisOne (keys %TotalProtoByteSent) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$TotalProtoByteSent{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . _convert($TotalProtoByteSent{$ThisOne}{$ThatOne},  %configConvert ) . " Byte(s)\n";

      }

   }

}

if ( ( $Detail >= 5 ) and (keys %ByteSent) ) {

   print "\nDevice Total Bytes sent by ports :\n";

   foreach $ThisOne (keys %ByteSent) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$ByteSent{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . _convert($ByteSent{$ThisOne}{$ThatOne}, %configConvert ) . " Byte(s)\n";

      }

   }

}

if (keys %NTPUpdated) {

   print "\nDevice where The system clock has been updated through NTP :\n";

   foreach $ThisOne (keys %NTPUpdated) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$NTPUpdated{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $NTPUpdated{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %NTPFailed) {

   print "\nDevice where failed to get clock through NTP :\n";

   foreach $ThisOne (keys %NTPFailed) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$NTPFailed{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $NTPFailed{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %DNSRefreshed) {

   print "\nDevice where DNS have been refreshed  :\n";

   foreach $ThisOne (keys %DNSRefreshed) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$DNSRefreshed{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $DNSRefreshed{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %SyslogFacility) {

   print "\nDevice where Syslog facility has been changed  :\n";

   foreach $ThisOne (keys %SyslogFacility) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$SyslogFacility{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $SyslogFacility{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %SyslogHost) {

   print "\nDevice where Syslog have been mail succesfully :\n";

   foreach $ThisOne (keys %SyslogHost) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$SyslogHost{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $SyslogHost{$ThisOne}{$ThisOne} . " Time(s)\n";

      }

   }

}

if (keys %Restarted) {

   print "\nDevice restarted :\n";

   foreach $ThisOne (keys %Restarted) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$Restarted{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $Restarted{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %AccessRuleAdded) {

   print "\nDevice where rules have been added :\n";

   foreach $ThisOne (keys %AccessRuleAdded) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$AccessRuleAdded{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $AccessRuleAdded{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %ReloadRequested) {

   print "\nDevice reload requested :\n";

   foreach $ThisOne (keys %ReloadRequested) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$ReloadRequested{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $ReloadRequested{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %SysCfgSaved) {

   print "\nDevice where system config have been saved :\n";

   foreach $ThisOne (keys %SysCfgSaved) {

      print "   " . $ThisOne . ":\n";

      foreach $ThatOne (keys %{$SysCfgSaved{$ThisOne}}) {

         print "\t " .$ThatOne . "\t: " . $SysCfgSaved{$ThisOne}{$ThatOne} . " Time(s)\n";

      }

   }

}

if (keys %BadLogins) {

    print "\nFailed logins from these:\n";

    foreach $ThisOne (keys %BadLogins) {

	print "   " . $ThisOne . ":\n";

	for (sort keys %{$BadLogins{$ThisOne}}) {

	    print "\t   $_: $BadLogins{$ThisOne}{$_} Time(s)\n";

	}

    }

}

if (keys %TCP_NULL_scan) {

    print "\nDevice whcih had been ports scanned :\n";

    foreach $ThisOne (keys %TCP_NULL_scan) {

	print "   " . $ThisOne . ":\n";

	for (sort keys %{$TCP_NULL_scan{$ThisOne}}) {

	    print "\t   $_: $TCP_NULL_scan{$ThisOne}{$_} Time(s)\n";

	}

    }

}

if (keys %BadAdminLogins) {

    print "\nFailed administrator logins from these:\n";

    foreach $ThisOne (keys %BadAdminLogins) {

	print "   " . $ThisOne . ":\n";

	for (sort keys %{$BadAdminLogins{$ThisOne}}) {

	    print "\t   $_: $BadAdminLogins{$ThisOne}{$_} Time(s)\n";

	}

    }

}

if (keys %IllegalUsers) {

    print "\nIllegal users from these:\n";

    foreach $ThisOne (keys %IllegalUsers) {

	print "   " . $ThisOne . ":\n";

	for (sort keys %{$IllegalUsers{$ThisOne}}) {

	    print "\t   $_: $IllegalUsers{$ThisOne}{$_} Time(s)\n";

	}

    }

}

if (keys %Users) {

    print "\nUsers logging in through :\n";

foreach $ThisOne (keys %Users) {

    print "   " . $ThisOne . ":\n";

foreach $user (sort {$a cmp $b} keys %{$Users{$ThisOne}}) {

    print "   $user:\n";

    my $totalSort = TotalCountOrder(%{$Users{$ThisOne}{$user}}, \&SortIP);

    foreach my $ip (sort $totalSort keys %{$Users{$ThisOne}{$user}}) {

	my $name = LookupIP($ip);

	if ($Detail >= 20) {

            print "      $name:\n";

            my $sort = CountOrder(%{$Users{$ThisOne}{$user}{$ip}});

            foreach my $method (sort $sort keys %{$Users{$ThisOne}{$user}{$ip}}) {

		my $val = $Users{$ThisOne}{$user}{$ip}{$method};

		my $plural = ($val > 1) ? "s" : "";

		print "         $method: $val time$plural\n";

            }

	} else {

            my $val = (values %{$Users{$ThisOne}{$user}{$ip}})[0];

            my $plural = ($val > 1) ? "s" : "";

            print "      $name: $val time$plural\n";

	}

    }

}

}

}

if ($#OtherList >= 0) {

   print "\n**Unmatched Entries**\n";

   print @OtherList;

}

exit(0);

# vi: shiftwidth=3 tabstop=3 syntax=perl et

# Local Variables:

# mode: perl

# perl-indent-level: 3

# indent-tabs-mode: nil

# End: