Log Analyzer for PIX messages

[sghezzi]

Hello,

we are using PIX 6.3(3) and we use Kiwi syslog for collecting logs.
We would also like to have a log analyzer to easily process PIX messages.
Can anyone suggest a good product?

Thanks
Silvia

 

[NetworkAdmin123]

I too am looking in this area.....we are thinking about sawmill which has a decent report

http://www.sawmill.net

I'm up for any other suggestions if anyone else has them.

 

[NetworkAdmin123]

http://www.sawmill.net

We use kiwi syslog as well.

 

[ForumKid]

Kiwi syslog is free and probably the most widely used. It has many great features and is a breeze to setup.

 

[NetworkAdmin123]

we use kiwi syslog to get the logs....sawmill is something I think your looking for. It takes the logs and formats them into a readable report sortable by days etc. We're using a free 30 day trial and it seems to be working well. It's only $99 to purchase which is nice.

 

[sghezzi]

Ok, this is exactly what we are testing now:
Kiwi Syslog + Sawmill (evaluation version)

so you suggest to go ahead with this scenario.

Good.

Thanks
Silvia

 

[agrigorof]

Try FireGen for Pix:

http://www.eventid.net/firegen/firegenpix2.asp

Sample report here:

http://www.eventid.net/firegen/mildco01-2004-03-12-165112-ondemand.html

If something is missing from this analyzer, just send an email to the developers, they would be happy to improve the product.

Regards,
Adrian Grigorof

http://www.eventid.net

 

[NetworkAdmin123]

We purchased Sawmill and are happy with it. I didn't know about FireGen though.

Opinions on both?

SGHEZZI- what did you end up doing?

 

[agrigorof]

Sawmill is basically just a web traffic analyzer. The "firewall" analysis section is quite basic and there is hardly any value in that information. Just compare the sample reports:

http://www.eventid.net/firegen/mildco01-2004-03-12-165112-ondemand.html

vs.

http://www.sawmill.net/cgi-bin/samp....66/netscreen"+cm+vs+filters+nofilters+asv+15

Besides the fact that there is no contest between the main reports, FireGen also offers IP Forensics (

http://www.eventid.net/firegen/ipforensics_report.asp)

and configuration analysis (

http://www.eventid.net/firegen/pixconfig-2004-03-17-220752.html).

Adrian Grigorof

http://www.eventid.net/firegen/firegenpix2.asp

FireGen for Pix Log Analyzer

 

[NetworkAdmin123]

Well when I license is up with Sawmill I'll look more closely at Firegen....Thx

 

[julianmd]

Currently, FireGen for PIX supports logs from the Cisco PIX* firewalls version 5.x and 6.1.x

This would be a minus!

 

[agrigorof]

Actually, it does support the 6.3.x PIX firmware. The Firegen website did not keep up with the software


Adrian Grigorof

http://www.eventid.net/firegen/firegenpix2.asp

FireGen for Pix Log Analyzer