Re: Log analyzers

I fully agree with Chris here. Besides his personal contribution to
SANS' curriculum, which are extremely useful for such a purpose, SANS
repository of papers written by Gold certified people, especially in
the GCIA section, contains a wealth of info about the many ways to
skin this kind of cat.

Another useful piece of info is to be found here:

http://www.sage.org/pubs/12_logging/members-only/chapter6.pdf

and even the whole booklet:
http://www.sage.org/pubs/12_logging/members-only/logging.pdf

for those having a SAGE account.

Stef

On 1/5/06, Chris Brenton <cbrenton@chrisbrenton.org> wrote:
> I'm kind of surprised no one has suggested simply writing your own
> script to deal with the data. There are some great text parsing tools
> out there (grep, Awk, Sed, Perl, etc. etc.) that can be leveraged to
> create a system that does exactly what you need. Another plus is it can
> be customized to work with any firewall logging format and easily
> tweaked to deal with multiple firewall products at the same time. Let me
> give you a few examples to get the wheels turning.
<snip>
> HTH,
> Chris