瞻博networking防火墙 – 可以报告stream量分析的软件？

我们决定使用Manage Engine的防火墙分析器。 仙人掌太难pipe理和维护，Splunk不会做我们以后的事情。

查看Splunk分析系统日志文件。

Cacti是一个开放源代码的graphics/警报解决scheme，与syslog-NG（开放源代码以及Syslog插件）一样的系统日志服务器应该能够满足您的需求。 仙人掌的伟大，虽然没有尝试过这个插件，但它是在我的（长）TODO软件评估列表。

你确定你想要一个商业解决scheme吗？ 我写了一个小的Perl脚本，可以做同样的事情。 看看它是否有用：

use strict; my $log = shift; my $n = shift || 5; open FILE, $log or die "Can't open the file"; my %connections; my %all_connections; while (<FILE>){ if (/^.*sent=(\d+) rcvd=(\d+) src=([\S+]+) dst=([\S+]+) src_port=(\d+) dst_port=(\d+).*$/){ my ($src_ip, $dst_ip, $dst_port, $bytes) = ($3,$4, $6, $2); my $src_port = ""; my ($src_int, $dst_int) = ("DMZ","TRUST"); # Calculating Top users based on connection counts $connections{$src_int." => ".$dst_int}{conn_count}{$src_ip." => ".$dst_ip}++; $connections{$src_int." => ".$dst_int}{src_count}{$src_ip}++; $connections{$src_int." => ".$dst_int}{dst_count}{$dst_ip}++; # Calculating Top users based on bytes transferred $connections{$src_int." => ".$dst_int}{conn_bytes}{$src_ip." => ".$dst_ip} += $bytes; $connections{$src_int." => ".$dst_int}{src_bytes}{$src_ip}+= $bytes; $connections{$src_int." => ".$dst_int}{dst_bytes}{$dst_ip}+= $bytes; $all_connections{sprintf ("%-36s => %-36s (%-6d) %12s",$src_ip, $dst_ip, $dst_port)} += $bytes; } } foreach my $connection (sort keys %connections){ print "--------------------------------------------------------------------------\n"; print "STATISTICS FOR CONNECTION ", $connection, "\n"; print "--------------------------------------------------------------------------\n"; print "\nTop $n Connections by Bytes transferred\n"; my $i = 0; printf ("%-56s %15s\n","Connection","Bytes Transferred"); printf ("%-56s %15s\n","----------","-----------------"); foreach my $conn_string (sort {$connections{$connection}{conn_bytes}{$b} <=> $connections{$connection}{conn_bytes}{$a} } keys %{$connections{$connection}{conn_bytes}}){ last if $i > ($n-1); printf ("%-56s %15.0f\n", $conn_string, $connections{$connection}{conn_bytes}{$conn_string}); $i++; } print "\n--------------------------------------------------------------------------\n"; print "\nTop $n Source by Bytes transferred\n"; my $i = 0; printf ("%-56s %15s\n","Source","Bytes Transferred"); printf ("%-56s %15s\n","------","-----------------"); foreach my $conn_string (sort {$connections{$connection}{src_bytes}{$b} <=> $connections{$connection}{src_bytes}{$a} } keys %{$connections{$connection}{src_bytes}}){ last if $i > ($n-1); printf ("%-56s %15.0f\n", $conn_string, $connections{$connection}{src_bytes}{$conn_string}); $i++; } print "\n--------------------------------------------------------------------------\n"; print "\nTop $n Destination by Bytes transferred\n"; my $i = 0; printf ("%-56s %15s\n","Destination","Bytes Transferred"); printf ("%-56s %15s\n","-----------","-----------------"); foreach my $conn_string (sort {$connections{$connection}{dst_bytes}{$b} <=> $connections{$connection}{dst_bytes}{$a} } keys %{$connections{$connection}{dst_bytes}}){ last if $i > ($n-1); printf ("%-56s %15.0f\n", $conn_string, $connections{$connection}{dst_bytes}{$conn_string}); $i++; } print "\n--------------------------------------------------------------------------\n"; print "\nTop $n connections by Connection count\n"; my $i = 0; printf ("%-56s %15s\n","Connection","Connection Count"); printf ("%-56s %15s\n","----------","----------------"); foreach my $conn_string (sort {$connections{$connection}{conn_count}{$b} <=> $connections{$connection}{conn_count}{$a} } keys %{$connections{$connection}{conn_count}}){ last if $i > ($n-1); printf ("%-56s %15d\n", $conn_string, $connections{$connection}{conn_count}{$conn_string}); $i++; } print "\n--------------------------------------------------------------------------\n"; print "\nTop $n Source by Connection count\n"; my $i = 0; printf ("%-56s %15s\n","Source","Connection Count"); printf ("%-56s %15s\n","------","----------------"); foreach my $conn_string (sort {$connections{$connection}{src_count}{$b} <=> $connections{$connection}{src_count}{$a} } keys %{$connections{$connection}{src_count}}){ last if $i > ($n-1); printf ("%-56s %15d\n", $conn_string, $connections{$connection}{src_count}{$conn_string}); $i++; } print "\n--------------------------------------------------------------------------\n"; print "\nTop $n Destination by Connection count\n"; my $i = 0; printf ("%-56s %15s\n","Destination","Connection Count"); printf ("%-56s %15s\n","-----------","----------------"); foreach my $conn_string (sort {$connections{$connection}{dst_count}{$b} <=> $connections{$connection}{dst_count}{$a} } keys %{$connections{$connection}{dst_count}}){ last if $i > ($n-1); printf ("%-56s %15d\n", $conn_string, $connections{$connection}{dst_count}{$conn_string}); $i++; } print "\n\n"; } printf ("%-30s %-36s %-6s %12s\n", "Source IP", "Destination IP", "Port", "Bytes"); printf ("%-30s %-36s %-6s %12s\n", "-------------------------------", "------------------------------------", "------", "------------"); #map {print $_->[0]."\n"} @all_connections; #print Dumper(\%all_connections); foreach my $connection (sort {$all_connections{$b} <=> $all_connections{$a}} keys %all_connections) { print "$connection $all_connections{$connection}\n"; } #map {printf ("%-36s (%-6d) => %-36s (%-6d) %12s\n", $_->[0], $_->[1], $_->[2], $_->[3], $_->[4])} sort {$b->[4] <=> $a->[4]} @all_connections;