Firewall analyzers - anyone?

[thehorse13]

I have the most excellent task of panning through gigs of firewall logs each day. Currently, we are using Firewall Analyzer by eiqnetworks and now someone made the decision to go with NetForensics. Does anyone here have first hand experience with this product? I have a bad feeling that some inside Cisco rep talked our CIO into this product

While I'm at it, does anyone have a favorite (freeware) logviewer?

Thanks to all in advance!

-TH13

[d0ppelg@nger]

I take it your using a Cisco device as your firewall? Since you said that "inside Cisco rep". There is one site that has a product, Sawmill, which can look at pretty much any file format for firewalls as well as web logs. I have never used it, but it looks interesting....

[thehorse13]

Thanks d0ppelg@nger,

Yeah, I know about the sawmill analyzer. It builds a database locally and you access your data through a web interface (it also runs a web server locally which tends to be annoying). The only problem with them is that you have to contact support to get the PIX plug-in during the 30 day trial period. That's when the sales buzzards start ringing the phone off the hook...LOL.