Router Log Analysis

[SoggyBottom]

Can anyone recommend a reporting tool for syslog router logs that can generate graphs, stats etc...

Im currently using WedTrends, whic is shite (in my opinion). Ive heard of some others like NetForensics, but I dont know how usefuly they are.

Any input would be much appreciated.

Thanks,
SoggyBottom

[KorpDeath]

Have you tried the new version of MRTG? RRDTool

It'll do it for you in a jiffy.

[gold eagle]

try cisco res mgr or hp openview - although it is $$$$

[niboreon]

I agree with both of the above recommendations, however MRTG has a number of advantages ... cost and platform independence if you are in a mixed environment.

If you have the money, in my opinion, nothing beats HP OpenView. (Even Cisco's management applications were dependent on it until only about 18 -24 mos ago.)

[nietzsche]

If you have the money, in my opinion, nothing beats HP OpenView.

Ummm ... yeah. with OpenView, you can drill down to just about any level... But for quick and dirty applications, one could use a spreadsheet for stats on the counts in an ACL. I'll be keeping an eye on this thread, as this is what I do at work, and all I'm doing there is syslog to another box and display via Excel (blah - our work boxes are Win 2k).

~N~

[niboreon]

Good Point, nietzsche !

ACL monitoring and spreadsheets work great for small networks...even for large networks where you want to closely examine a particular issue.

I had gotten the impression that SoggyBottom was looking for something more robust???

There are quite a number of commercial tools available, actually. But to filter them one must take into account cost, functionality and network size. I'm not generally into the swiss-army knife approach

I look forward to reading about what others are using or have investigated using.

[SoggyBottom]

Thanks for all your replies,

I will investigate all of your recommendations.

Another important thing to note is, that our daily syslog files can get up to 16MB. As I usually generate these logs for each week (cause Im a lazy ass), so at one time, I am usually processing about 100MB of logs!

I have also heard of a software package called NetForensics, and from what I have heard, it is quite good.

http://www.netforensics.com/

Has anyone used this package?

Cheers,
SoggyBottom

[iNViCTuS]

netforensics is a good product.

MRTG will not give much detail about individual connections, it is used more for performance or utilization reporting. I do agree with you that Webtrends needs some work, but also try Websense http://www.websense.com it may do what you need.