Solved

Help with PIX, Syslog, KIWI

Posted on 2004-09-15
3
1,340 Views
Last Modified: 2010-04-09
I have a pix firewall 501.  I need to parse the syslog files into something I can use with crystal reports.  So in essence I need date, time, source ip, destination ip (or url),

I have been playing with kiwi but have not been able to get it to work as I am sure of all the steps involved.  
Need help in steps (like setup custome file format, then setup output file, then ....) in getting this working.

Also need help (I believe) in getting a custom script in kiwi to output above.  

Thanks for your help and guidance.

Terry
0
Comment
Question by:terryhdbailey
  • 2
3 Comments
 
LVL 23

Expert Comment

by:Tim Holman
Comment Utility
You've managed to setup syslog to send data from PIX to Kiwi ?
This shows you how:

http://www.cisco.com/warp/public/110/pixsyslog.html#pi4.3x

Now...  as for file formats, I wouldn't bother messing around with them, but get a product that understands PIX syslog files - like eiqFirewallAnalyzer http://www.eiqnetworks.com/products/securityanalytics.shtml, or Network Intelligence (super-capable SYSLOG server), or SawMill http://www.sawmill.net/formats/PIX_Firewall_Syslog_Server_Format.html or A.N.Other - there are plenty around !!

0
 

Author Comment

by:terryhdbailey
Comment Utility
Does Sawmill also capture the syslog  or does it have to be captured with something else?

Yes I have the pix 501 sending me syslog messages now.  udp port 514.


thanks terry
0
 
LVL 23

Accepted Solution

by:
Tim Holman earned 500 total points
Comment Utility
It's a log file analyser, so you do need a syslog server at some stage to generate the logs for Sawmill to analyse.
Here's another reasonable log analysis tool:

http://www.reportgen.com/downloads.htm

The intergrated syslog servers / log analyzers tend to cost a LOT more !!
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

This is about downgrading PIX Version 8.0(4) & ASDM 6.1(5) to PIX 7.2(4) and ASDM 5.2(4) but with only 64MB RAM and 16MB flash. Background: You have a Cisco Pix 515E which was running on PIX 7.2(4) and its supporting ASDM 5.2(4) without any i…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now