Newbie logging question.

[ajb822]

I am pretty new to the PIX but I have setup up logging to a syslog server using Kiwi. I also have Sawmill installed for reporting. What I would like to report on is bandwidth usuage and also any information that would point to external attacks of the firewall. What logging levels should I enable on the pix to receive this kind of information and what reports in Sawmill would generate this.

Thanks,

Tony

 

[WebSpyExpert]

If you are using Cisco Router on the end you can enable Netflow and use WebSpy Flowmonitor, in conjuction with Analyzer Standard and have byte accurate data for Bandwidth, Attacks.
Both are available at

http://www.webspy.com

for a free 30 day evaluation.

 

[agrigorof]

Level 6 logging will provide you with all that you need. The rest depends on the reporting software. See these links:

http://www.eventid.net/firegen/mildco01-2004-03-12-165112-ondemand.html

and

http://www.eventid.net/firegen/firegenpix2.asp

for an example of what you can get from the Cisco Pix logs using the FireGen for Pix Log Analyzer:

http://www.eventid.net/firegen/firegenpix2.asp

Adrian Grigorof

http://www.eventid.net/firegen/firegenpix2.asp

FireGen for Pix Log Analyzer