From owner-freebsd-security Tue Sep 19 8: 0:19 2000 Delivered-To: freebsd-security@freebsd.org Received: from point.osg.gov.bc.ca (point.osg.gov.bc.ca [142.32.102.44]) by hub.freebsd.org (Postfix) with ESMTP id 86D3837B422 for ; Tue, 19 Sep 2000 08:00:14 -0700 (PDT) Received: (from daemon@localhost) by point.osg.gov.bc.ca (8.8.7/8.8.8) id IAA21516; Tue, 19 Sep 2000 08:00:04 -0700 Received: from passer.osg.gov.bc.ca(142.32.110.29) via SMTP by point.osg.gov.bc.ca, id smtpda21514; Tue Sep 19 08:00:01 2000 Received: (from uucp@localhost) by passer.osg.gov.bc.ca (8.9.3/8.9.1) id IAA96459; Tue, 19 Sep 2000 08:00:01 -0700 (PDT) Received: from cwsys9.cwsent.com(10.2.2.1), claiming to be "cwsys.cwsent.com" via SMTP by passer9.cwsent.com, id smtpdZ96443; Tue Sep 19 07:59:48 2000 Received: (from uucp@localhost) by cwsys.cwsent.com (8.11.0/8.9.1) id e8JExlb06601; Tue, 19 Sep 2000 07:59:47 -0700 (PDT) Message-Id: <200009191459.e8JExlb06601@cwsys.cwsent.com> Received: from localhost.cwsent.com(127.0.0.1), claiming to be "cwsys" via SMTP by localhost.cwsent.com, id smtpdwt6594; Tue Sep 19 07:58:56 2000 X-Mailer: exmh version 2.1.1 10/15/1999 Reply-To: Cy Schubert - ITSD Open Systems Group From: Cy Schubert - ITSD Open Systems Group X-OS: FreeBSD 4.1-RELEASE X-Sender: cy To: "Hudson, Henrik H." Cc: "'security@freebsd.org'" Subject: Re: IPFW Log Auditing? In-reply-to: Your message of "Tue, 19 Sep 2000 07:42:54 CDT." Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Tue, 19 Sep 2000 07:58:56 -0700 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message , " Hudson, Henrik H." writes: > Morning List- > > I have been trying to find something will do log auditing/scanning of > already existing IPFW logs? Does such a tool exist? > > There is IPLOG, but doesn't that generate it's own logs and scan those? or > snort, but that's almost like IPLOG, right? Of course, I could be reading > the FAQ's backwards too. > > While on this subject, if I have to use something like IPLOG/snort, does > this still capture info about packets that IPFW has denied? What's the > performance decrease on a machine that is running IPFW rules and iplog? > anything noticable besides increased disk space needs? > > Any other thoughts I should be having? Take a look at swatch. At home I run it daily to produce a colourized listing of my firewall logs. At work we run it as a daemon to initiate automated call-out to our pager/cell phones. The next phase of our automated logging project will use swatch to open Remedy tickets. Swatch is in the ports collection. Regards, Phone: (250)387-8437 Cy Schubert Fax: (250)387-5766 Team Leader, Sun/DEC Team Internet: Cy.Schubert@osg.gov.bc.ca Open Systems Group, ITSD, ISTA Province of BC To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message