The pix-summarize log file analyzer has been useful at the University of Rochester for reducing huge incomprehensible log files down to much smaller and useful summaries.
It is offered as-is, but if you try it and find it useful (or decide to enhance it), please let me know.
Liudvikas Bukys
bukys@rochester.edu
June 6, 2002
You can supply a file of conduit statements, and it will parse and understand them, and will summarize which conduits are responsible for which permit/deny log entries. This is moderately nice for quickly determining which one kicked in, but very helpful for taking old logs and new conduit settings, and simulating the effects of new rules.
You can supply a file of summarization rules using host and port patterns in various combinations, and use this to selectively boil down (group together) entries related to specific hosts and ports. If a port scanner generates 65000 entries, add a summarization rule which says that all destination port get converted to "*". If a host scanner generates 65000 entries, add a summarization rule which boils down all destination hosts to sub.net.*.*.
I can't vouch for it for anything beyond PIX 5.0(3) and Sun/Solaris syslog. "Private-I" syslogs are close enough. Other syslog sources may require tweaking of the input parsing line.
Parsing conduits but not ACLs is a bit retro. But providing conduits is optional anyway.
It contains a small amount of UR address-space hard-coding, which won't interfere with your use it of it -- but you may want to add patterns so it will specifically pick out and label areas of your address space too.