Php-Syslog-ng worked pretty well, when I tested it. Think about using
Stunnel also for moving the logs across the network in a secure channel.
-----Original Message-----
From: jkowall [mailto:jkowall@shocking.net]
Sent: Wednesday, February 09, 2005 8:48 PM
To: Carey Heck
Cc: pen-test@securityfocus.com; bugtraq@securityfocus.com
Subject: Re: Data Mining for PIX Firewall Logs
First you will have to log the data via syslog. I reccomend
kiwi syslog daemon for windows. The pro version is cheap and
it can do compression, rotation, and filtering. It can also
do email based alerting.
Syslog-ng for*NIX is by far the most extensable and advanced
daemon for *NIX.
Now that you have the files, I would reccomend the following products:
http://www.sawmill.net/
Sawmill not only processes PIX easily, but it can also
process anything from sendmail, to IIS logs. Its a great
tool. Well priced, and processes hundreds and hundreds of
different logfiles.
http://www.surfstats.com/sla_pro.asp
Decent product, haven't used it much
http://www.softland.com.ar/info/eiqnetworks/firewallan/submain.htm
Expensive last time I looked, never used it.
http://tud.at/programm/fwanalog/
Free logfile processor, the reports are pretty basic.
http://perlmonks.thepen.com/123707.html
Script to monitor a log and page/email.
http://www.itefix.no/phpws/index.php?module=pagemaster&PAGE_us
er_op=view_page&PAGE_id=21&MMN_position=21:21
Never used this one/
There are a couple other ones too, but these are some of the
main ones.
good luck, email with any additional questions.
-jk
Carey Heck wrote:
Hi folks. I love the ability in the Checkpoint firewall
logging applet
that allows me to load up any former saved log file, and filter
according to any criteria I set.
Lets use an example:
I want to show an auditor what exactly went through my firewall,
to/from a specific DMZ host, between the hours of 1 and 3pm GMT, on
July 8th, 2003.
In checkpoint, if I had correctly configured my ruleset, and
archived
my log files properly, I could provide this answer within 30 minutes.
Fast forward to my current company, which went with a Cisco PIX
solution based on the up front cost. I can log all the
connections to
my heart content, but boy mining the data to help show what
happened in
my above example has been tiresome at best.
Can anyone here please suggest to me some type of logging and more
relevantly, a data mining product that can help me achieve this end?
Currently I am logging all my PIX traffic to a host running
Kiwi syslog
daemon, which archives each days logs into a separate folder in the
dated logs directory, creating a new directory named for
each date in
the year.
I am looking for a less clunky solution.
Any help is GREATLY appreciated.
Thanks!
