Log Analyzer for Juniper Secure Access (SSL) User Logs

[jmn_]

Does anyone know of a good log analyzer for Juniper SA user logs. Would like to input logs in "standard" format to generate user session statistics including username, authentication time, total session time, and end time. Looked at sawmill, but it doesn't appear it supports what I am looking for.

[bcampbell3_]

Sawmill works like a champ! I'd check it out... at least run the trial. http://www.sawmill.net/

If you aren't getting what you want with Sawmill, call their support. I called them and they will basically bend over backwards to help you get what you want out of their product. If not... there are other options... just not ones I remember being in the same ballpark as Sawmill.

Message Edited by bcampbell3 on 08-11-2009 06:24 AM

[stine_]

If you're looking for a $$$ solution, try www.logrhythm.com. They have support (albiet kind of haphazard) for several Juniper models (among the 1400+ that they support).

If you're simply looking for a log collector, try www.splunk.com. The configuration takes about 15 seconds, but the user interface (at least pre 4.0) is not very intuitive, but it is easy to search.

[amonte1_]

Another good $$$ product is called Clearview from NWG Technologies. Its an appliance and the GUI is very much Juniper SA like.

http://www.nwgtechnologies.com/

Tony

[cheong.ketvin_]

Which syslog format works for Juniper SA? There's a long list that Im not sure which to pick. Output as "Standard" at Juniper SA. Thanks!

[cheong.ketvin_]

Refering to Sawmill syslog format.

[Avenger_]

Sawmill should automatically detect the log format for you (it does with out 6.5R3.1 logs). --Avenger