Router Log Analysis

Can anyone recommend a reporting tool for syslog router logs that can generate graphs, stats etc...

Im currently using WedTrends, whic is shite (in my opinion). Ive heard of some others like NetForensics, but I dont know how usefuly they are.

Any input would be much appreciated.

Thanks,
SoggyBottom

Have you tried the new version of MRTG? RRDTool

It'll do it for you in a jiffy.

try cisco res mgr or hp openview - although it is $$$$

I agree with both of the above recommendations, however MRTG has a number of advantages ... cost and platform independence if you are in a mixed environment.

If you have the money, in my opinion, nothing beats HP OpenView. (Even Cisco's management applications were dependent on it until only about 18 -24 mos ago.)

Quote:

---

If you have the money, in my opinion, nothing beats HP OpenView.

---

Ummm ... yeah. with OpenView, you can drill down to just about any level... But for quick and dirty applications, one could use a spreadsheet for stats on the counts in an ACL. I'll be keeping an eye on this thread, as this is what I do at work, and all I'm doing there is syslog to another box and display via Excel (blah - our work boxes are Win 2k).

~N~

Good Point, nietzsche !

ACL monitoring and spreadsheets work great for small networks...even for large networks where you want to closely examine a particular issue.

I had gotten the impression that SoggyBottom was looking for something more robust???

There are quite a number of commercial tools available, actually. But to filter them one must take into account cost, functionality and network size. I'm not generally into the swiss-army knife approach :p

I look forward to reading about what others are using or have investigated using.

Thanks for all your replies,

I will investigate all of your recommendations.

Another important thing to note is, that our daily syslog files can get up to 16MB. As I usually generate these logs for each week (cause Im a lazy ass), so at one time, I am usually processing about 100MB of logs!:eek:

I have also heard of a software package called NetForensics, and from what I have heard, it is quite good.

http://www.netforensics.com/

Has anyone used this package?

Cheers,
SoggyBottom

netforensics is a good product.

MRTG will not give much detail about individual connections, it is used more for performance or utilization reporting. I do agree with you that Webtrends needs some work, but also try Websense http://www.websense.com it may do what you need.