There are format changes between IDP v2.1/3.x to 4.0 (via NSM) vs 4.1 Direct.
The format is described in their users manual. I cut-n-pasted some text from their user manuals
(please verify the format from their manual)
for IDP 3.x/2.1
===========
<day id>-<record id> <timestamp> <sensor addr> <src addr>:<src port> <dst
addr>:<dst port> <nat src addr>:<nat src port> <nat dst addr>:<nat dst port>
<user> <in nic> <out nic> <sensor vin> <virtual dev> <attack> <policy
name>:<policy ver> <rulebase> <rule number> <bytes> <packets> <elapsed>
<protocol> <category>-<subcategory> <action> <session id1>-<session id2> <is
hidden> <is duplicate> <is alert> <severity> <run script> <send email> <send
snmp> <send syslog>
for 4.1
=====
Syslog Message Format
The format of the syslog message sent by the IDP Sensor is as follows:
<day id>, <record id>, <timeReceived>, <timeGenerated>, <domain>,
<domainVersion>, <deviceName>, <deviceIpAddress>, <category>, <subcategory>,
<src zone>, <src intface>, <src addr>, <src port>, <nat src addr>, <nat src port>, <dst
zone>, <dst intface>, <dst addr>, <dst port>, <nat dst addr>, <nat dst port>,
<protocol>, <rule domain>, <rule domainVersion>, <policyname>, <rulebase>, <rule
number>, <action>, <severity>, <is alert>, <elapsed>, <bytes in>, <bytes out>, <bytes
total>, <packet in>, <packet out>, <packet total>, <repeatCount>, <hasPacketData>,
<varData Enum>, <misc-str>, <user str>, <application str>, <uri str>
Example:
[
syslog@juniper.net dayId="20061012" recordId="0" timeRecv="2006/10/12
21:52:21" timeGen="2006/10/12 21:52:21" domain="" devDomVer2="0"
device_ip="10.209.83.4" cat="Predefined" attack="TROJAN:SUBSEVEN:SCAN"
srcZn="NULL" srcIntf="NULL" srcAddr="192.168.170.20" srcPort="63396"
natSrcAddr="NULL" natSrcPort="0" dstZn="NULL" dstIntf="NULL"
dstAddr="192.168.170.10" dstPort="27374" natDstAddr="NULL" natDstPort="0"
protocol="TCP" ruleDomain="" ruleVer="5" policy="Policy2" rulebase="IDS"
ruleNo="4" action="NONE" severity="LOW" alert="no" elaspedTime="0" inbytes="0"
outbytes="0" totBytes="0" inPak="0" outPak="0" totPak="0" repCount="0"
packetData="no" varEnum="31" misc="<017>'interface=eth2" user="NULL"
app="NULL" uri="NULL"]
Print