Re: Reading firewall logs

[Bill_Royds () pch gc ca]

I use Perl scripts to summarize important events. For example I have a script
that looks at all rejected packets, ICMP redirects etc. that firewall sees and
summarizes by source/srcport -> destin/dstport (ICMP type). so that I can
quickly see if certain exploits are being attempted. We get about 500MB of
firewall logs a day (including legitimate usage) so anomaly detection is
impossible by eyeball.
  Perl is probably the most useful log tool followed by Excel or someother
spreadsheet to slice and dice results