CiscoPIXFirewallSysLog.xml

<SysConfig>
<Package>
<IsActive>true</IsActive>
<PackageID>10</PackageID>
<Event>
<MatchString>SYS-5-CONFIG</MatchString>
<PullConfig>1</PullConfig>
</Event>
<Event>
<MatchString>PIX-5-111005</MatchString>
<PullConfig>1</PullConfig>
</Event>
<Event>
<MatchString>PIX-5-111008</MatchString>
<ChangedBy>User '(.*)' executed the 'enable' command</ChangedBy>
</Event>
<Event>
<MatchString>ASA-5-111008:.*configure terminal.</MatchString>
<ChangedBy>User '(.*)' executed the 'configure terminal' command</ChangedBy>
<PullConfig>1</PullConfig>
</Event>
<Event>
<MatchString>ASA-4-111008:.*configure terminal.</MatchString>
<ChangedBy>User '(.*)' executed the 'configure terminal' command</ChangedBy>
<PullConfig>1</PullConfig>
</Event>
<Event>
<MatchString>FWSM-4-111008:.*configure terminal.</MatchString>
<ChangedBy>User '(.*)' executed the 'configure terminal' command</ChangedBy>
<PullConfig>1</PullConfig>
</Event>