Need Cisco tool for Netscreen / Checkpoint type logging

[Greg Ferro]

I am working on a site that is using Checkpoint and the Checkpoint logging has a very useful feature that is able to collect logs constantly. You can then search those logs later to see what has happended after the fact. netscreen also supports the same functions when you are using the Netscreen Security Manager.

I am looking for the same feature for Cisco ASA firewalls. I am using Cisco Security Manager 3.1, RME 4.0.5 and a bunch of Open Source tools, but nothing really comes close to this feature. I can't find anything within CSM, it seems to be a configuration tool only.

I am hoping someone else has this experience and can point me towards a Cisco product that has the same function ?

Thanks

greg

[jreekers]

Hi Greg,

I'm not very familiar with Checkpoint software, so I'm not exactly sure what you're looking for, but I think RME's custom reporting tools might be helpful to you. Also, the Sylog Analyzer functionality within RME (which you mention you have installed) could be useful to you in "after-the-fact" discovery of device events.

You can read a little more about RME's custom reporting capabilities here:

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000e/e_4_x/rme405/405ug/reports.htm

and in the online help within RME.

HTH,

-Joe

[jreekers]

Hi Greg,

I'm not very familiar with Checkpoint software, so I'm not exactly sure what you're looking for, but I think RME's custom reporting tools might be helpful to you. Also, the Sylog Analyzer functionality within RME (which you mention you have installed) could be useful to you in "after-the-fact" discovery of device events.

You can read a little more about RME's custom reporting capabilities here:

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000e/e_4_x/rme405/405ug/reports.htm

and in the online help within RME.

HTH,

-Joe