topic Re: IDS logging and Linux in Network Security

IDS logging and Linux

giovanni.mellini — Sun, 10 Mar 2019 09:23:39 GMT

Hi all.

I have an IDS configured on a PIX515e.

Information messages and Alarm messages generated generated from PIX are logged in a Linux box.

I appreciate any suggestion about some Linux tool that I can use to parse this log.

Tks in advance

Giovanni

Re: IDS logging and Linux

akhan2004 — Thu, 14 Apr 2005 08:52:37 GMT

Hi Giovanni

what do u mean by linux box here, that meant Linux OS is running on IDS appliance.

Do you have VMS or IDM ?

Re: IDS logging and Linux

giovanni.mellini — Fri, 15 Apr 2005 06:21:27 GMT

I have configured the logging facielities of PIX Firewall so the firewall can write log messages (alarms and info) om my Slack10.1 server usins linux syslog.

Yesterday I tryed an open source log analyzer, fwanalog, it seems to be a good choice.

If someone else is interested in

http://tud.at/programm/fwanalog/

Tks for the answer

Giovanni

Re: IDS logging and Linux

darin.marais — Fri, 15 Apr 2005 08:21:24 GMT

I have not read this entire paper myself but when I saw your question regarding the analysis of Cisco logs, I though that you could do with all of the information you can get your hands on.

Take a look at this URL and let me know if it helps you in anyway.

http://www.networkingunlimited.com/white007.html

Re: IDS logging and Linux

giovanni.mellini — Fri, 15 Apr 2005 09:18:09 GMT

The paper focus on router logs, and I'm interested in PIX logs, but there is some useful information.

Also if I have found a good graphical analyzer (fwanalog), I started to write a shell-based pix log analyzer today.

The primary intent of this analyzer is to help me for a more accurated tuning of ACL in my PIX, according to

http://www.cisco.com/en/US/partner/products/sw/iosswrel/ps1830/products_feature_guide_chapter09186a00800881c0.html

and then prevent false positives that can occour.

The report generated must take information about attack only logs, and then generate some stats (eg. source and dest ip, source and dest interface...), so I can create a more accurated ACL on my signature.

I'll post some news about.

Tks