ASA syslog parsing…

The ASA syslog format can be a bit of a pain to parse, especially when you want a concise list of the access a host has been granted or denied via the firewall. The original log format looks like this:

00:00:00 %ASA-6-106100: access-list inside permitted tcp Inside/ -> Outside/ hit-cnt 1 first hit [0x62c4905, 0x0]

Lets clean this up a bit with the following command, for this example we only care about the permitted access across the inside interface

$grep access-list\ inside\ permitted <SYSLOG FILE>.log | sed -e 's/\// /g' | sed -e 's/(.*>//' | awk '{print $7,$8,$9,$10,$11}'

This will result in the following:

tcp Inside Outside

Obviously you would be left with a few thousand entries like the one above, now you can add a unique sort to the mix and clean things up, the whole thing will look like this:

$ grep access-list\ inside\ permitted <SYSLOG FILE>.log | sed -e 's/\// /g' | sed -e 's/(.*>//' | awk '{print $7,$8,$9,$10,$11}' | sort | uniq -c | sort -nr

Find all log files in various directories and grep them….

My central syslog server creates a folder hierarchy as follows:

/data/logs/[system name]/month/day.log

Sometime I need to grep multiple logs across several specific devices.  Using find, grep and xargs we can accomplish this as follows:

find *server* -type f | grep 08/03.log | xargs grep interesting_traffic

The above will return a list of all the files within any folder containing the phrase `server`, then it filters out the logs for the date 08/03 and lastly it greps them for the phrase `interesting_traffic`.  Easy!

XBMC and Boxee with HDMI Audio

On my Asus M3A78-EM running Ubuntu 9.04 I use  XBMC and Boxee for media playback. I recently had the need to output audio over s/pdif optical and via HDMI due to the fact that I have a HDMI switch to send the output to two separate LCDs.  I also have a MSI N9400GT-MD512H GeForce 9400 GT installed in this box to perform VDPAU video hardware acceleration.  As you may or may not know this GeForce card requires a 2 pin s/pdif cable to be run from the motherboard to video card.  In order for HDMI audio to function you must go into your bios and set the `SPDIF OUT mode` setting to ‘SPDIF Output’.  One the system is back online, be sure to disable Pulse Audio as it does not play well with Boxee and XBMC. Next you need to have the latest ALSA v1.0.22 installed, a nice upgrade script for Ubuntu can be found here . To check what version you have installed check the following file:

htpc@Electric:/media/sda3$ cat /proc/asound/version
Advanced Linux Sound Architecture Driver Version
Compiled on Feb 21 2010 for kernel 2.6.28-18-generic (SMP).

Ok, once you have the latest version installed you need to configure your /etc/asound.conf  file as follows:

pcm.!default {
type plug
slave {
pcm “spdif”
rate 48000

EDIT 2/22/2010:  I found that under the latest Boxee Beta I could not get sound to function at all!  On a hunch I deleted the asound.conf file above and everything including navigational sounds worked like a charm . XBMC also function perfectly, so I really question the need for the global asound.conf file above.

You may also want to check in your home folder to be sure that you don’t have any custom asound configuration files, you really should remove these as to not cause any confusion.

Go ahead and do a reboot if you have not done so. Once the system is back up you should run alsamixer and turn all your volume levels up, pay special attention to the SPDIF levels  be sure they are unmuted. An unmuted channel will have a ‘OO’ and a muted channel will have a ‘MM’.  Once you have your levels set run ‘sudo alsactl store 0′ to save your settings.  Lastly, in Boxee and XBMC set your audio settings as follows:

Audio output———————————-Digital
-Dolby Digital (AC3) Capable receiver—-off
-DTS Capable Receiver———————–off
Audio ouput device————————–default
Passthrough output device——————iec958
Downmix multichannel audio to stereo—on

These are the setting I have to use for everything to work with an older Sony XBR1 I have, the TV does not seem to be able to support Dolby Digital or any special formats.  Good Luck.