From owner-freebsd-questions@FreeBSD.ORG Fri Jun 18 10:42:54 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E0DD216A4CE for ; Fri, 18 Jun 2004 10:42:54 +0000 (GMT) Received: from redfirst.wax.co.uk (redfirst.wax.co.uk [212.134.89.140]) by mx1.FreeBSD.org (Postfix) with ESMTP id 54ECD43D2D for ; Fri, 18 Jun 2004 10:42:54 +0000 (GMT) (envelope-from uwe.kolsch@wax.co.uk) Received: from uwe (clients.wax.local [212.158.204.132]) (authenticated bits=0) by redfirst.wax.co.uk (8.12.6/8.12.6) with ESMTP id i5IAfNMF029677; Fri, 18 Jun 2004 11:41:27 +0100 From: "Uwe Kolsch" To: "Giorgos Keramidas" Date: Fri, 18 Jun 2004 11:41:23 +0100 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) In-Reply-To: <20040618103345.GA18531@orion.daedalusnetworks.priv> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 Importance: Normal X-MailScanner-Information: Please contact the administrator for more information X-redfirst.wax.co.uk-MailScanner: Found to be clean cc: freebsd-questions@freebsd.org Subject: RE: IPFW log results analysis X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Jun 2004 10:42:55 -0000 > -----Original Message----- > From: Giorgos Keramidas [mailto:keramida@ceid.upatras.gr] > Sent: 18 June 2004 11:34 AM > To: Uwe Kolsch > Cc: freebsd-questions@freebsd.org > Subject: Re: IPFW log results analysis > > > On 2004-06-18 10:43, Uwe Kolsch wrote: > > Is there a tool for FBSD like logwatch on Linux, which can provide > a detailed > > but still somehow summarized output based on the logging results of > IPFW. I mean > > more detailed than this from the daily security run: > > > > > 02010 557 48486 deny log ip from any to any out > > > 10000 1026 49716 deny ip from any to any in setup > > > 10003 3859 828227 deny ip from any to any in > > > > ... and more like this. > > You can always write your own shell scripts to parse ipfw logs ;-) And how do I use a keyboard? > I haven't heard of any summarizing tools, but if you feel that scripting > your own is too much it shouldn't be too hard to roll a few custom > scripts if you tell me what you're looking for in such a report. > > - Giorgos