Re: Firewall Log Analysis

["Saravana Ram" <Ram () POP Jaring My>]

> To get the log files, I propose to regularly FTP the files (in zipped
version,
> once a day, automatically)from the firewalls to a centralised machine.
This
> machine run a log anaysis software.  The report may be FTP'ed back or put
up on
> a website.

> 1) Are there any better approaches to do this?

Do make sure that the firewalls ftp OUT the log files to your central
machine. Don't run ftpd (or any) services on your firewalls. FTP itself is
insecure, try to use ssh's file transfer mechanism instead, or any other
means of secure file transfer.