Re: [Wallfire-users] Using wflogs/cisco_pix for ip accounting

[Herve E. <rv...@wa...>]

On Wed, May 07, 2003 at 08:54:20PM +0200, Friedhelm Düsterhöft wrote:

 Hi,

> Well, really a huuuge list. To get out the most with the least effort I
> would suggest to start
> with  PIX-6-302014 and PIX-6-302016 messages. This would allow for an
> accounting of
> TCP and UDP bytes of legitimate connections.

You know, wflogs was not designed to be an accounting tool, but for
the moment it gathers information about filtered (or non-filtered)
connections.
As you know, a serious security policy is "allow a few connections,
drop all the rest", and it doesn't make much sense to log what is
accepted (at least at the filter level).
So... of course you can use values provided by a firewalling tool for
accounting, but if it's not for firewalled (understand blocked)
connections, it's generally a bad idea.

So messages like number 106010 (and equivalents) seem much more
important to me in the first place.

 Herve

-- 
 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/


> ----- Original Message -----
> From: "Hervé Eychenne" <rv...@wa...>
> To: "Friedhelm Duesterhoeft" <fd...@ms...>
> Cc: <wal...@li...>
> Sent: Monday, April 28, 2003 8:07 PM
> Subject: Re: [Wallfire-users] Using wflogs/cisco_pix for ip accounting


> > On Sun, Apr 27, 2003 at 11:31:44PM +0200, Friedhelm Duesterhoeft wrote:
> >
> >  Hi,
> >
> > > thanx for your reply. Please find attached some sample logs (only PIX-6
> > > lines). I think the sample should include all sorts - at least all I'm
> > > interested in at the moment ;-). At at first view there are not too many
> > > variations so I hope it's not very hard for you to build the regexps
> > > required.
> >
> > > It would be nice if you could include pix info level parsing in one of
> the
> > > next releases. Wflogs rocks - thanks alot for your efforts!
> >
> > Please have a look at
> >
> http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63sysl
> og/pixemsgs.htm
> >
> > As you can see, one can spend some time sorting out meaningful messages
> > for wflogs...  :-/
> > Friedhelm, if you (or someone else) want to gather all error messages
> > that should be treated by wflogs, I would be glad to do the parsing as
> > quickly as possible.
> >
> >  Hervé