Best logging format

[Tinribs]

Just interested what firewall people think has the most 'informative' logging system.

I currently use sygate and its good, but the logs often leave a bit to be desired,especially after a logged port scan.
What I did remember though from previous ZA useage is the logging and alerting of every sneeze and cough worldwide, is there a firewall thats recommeneded for its sensible ogging?

Over the months and years I have tried (in different releases)
Sygate (current version)
Sygate Pro(current v)
ZAF
ZAP (current v)
Black Ice PC Protection 3.6 (current V)
Kerio 2.14
Kerio 3 beta 6

Help...

[the Tester]

Tinribs.

I like the logging feature in LooknStop.

I have tried:
Zone Alarm
Sygate
Kerio 2.1.4
Kerio 3b6
(I never tried any of the Pro verions of ZA or Sygate,so I don't know what their logs look like)

LnS provides a lot of detail IMO.
There are screenshots,including the log at this link:
http://www.looknstop.com/En/firewall.htm

[solarpowered candle]

Yea look n stop is a very tidy firewall.

[Patrice]

Hi guys!

I have to say the above mentioned is correct. Look'n'Stop has a very nice logging feature. Especially all logs are saved day by day on your computer. So you don't loose control of it.

I was using these firewalls:

Zone Alarm Pro
Norton Internet Security 2002 (what a crap!) >:(
Look'n'Stop

Since then I'm using Look'n'Stop and I don't think I will change that fast, because I'm more than happy with it! ;D

Regards,

Patrice

[Ph33r_]

If you in Reference specifically to “Log to file”; Look ‘n’ Stop contains numerous Features regarding this,

-{ Quote: " From: Look ‘n’ Stop Help File

* select box 'Log file' is useful to save the content the content of the log to a file. If selected, a log file is created per day in the log folder. The file name is the date. To avoid the folder growing you can select to remove old files automatically, just enter a number of days." }-

In Addition to that Feature;

-{ Quote: " From: Look ‘n’ Stop Help File

* 'Raw log': in addition of standard text log files, this option creates log files with more information. These kind of files may be used in third party programs which decodes log files. These files are also created in the log folder and are prefixed with 'raw'." }-

Who would figure an Additional “Raw Log” Feature to the Standard text logging, especially since I see quite so more Informatics giving with Look ‘n’ Stop’s Standard logging to file compared to most Software Firewall’s Logs…

The only dislike I have in regards to Look ‘n’ Stop Logging Feature is that only that which gets logged to file is that which has “Warning Flag” set which Displays packets in “Log” screen, the only current way it’ll capture to Log File… And hopefully soon we’ll see few Additions like Rule doesn’t need a “Warning Flag” set to be capable of Logging to file…
" }-" }-

[Patrice]

Hi Ph33r!

Nice to meet you again!
-{ Quote: " quoting: Ph33r_ link=board=23;threadid=8754;start=0#56917 date=1051355017]The only dislike I have in regards to Look ‘n’ Stop Logging Feature is that only that which gets logged to file is that which has “Warning Flag” set which Displays packets in “Log” screen, the only current way it’ll capture to Log File… And hopefully soon we’ll see few Additions like Rule doesn’t need a “Warning Flag” set to be capable of Logging to file…" }-

Funny, but that's exactly what I like! ;) For example in Application filtering, I don't want that every single application which tries to connect to the internet is logged. Just some, so that I don't loose the overall view. It's the same for the Internet filtering. Less is more, as you certainly know.

And what's the matter with the Warning Flag? Just set for every Application and Internet rule a flag, then everything will be logged and you don't have to care about it again.

Best regards!

Patrice

P.S. Ph33r why don't you register here, your statements are more than welcome! You already spend a lot of time in here... ;)

[Tinribs]

Thanks guys, I guess I'll give Look n stop a whirl for a bit, I did mean to give it a look anyway. :)

[Ph33r_]

Hey Patrice

-{ Quote: " And what's the matter with the Warning Flag? Just set for every Application and Internet rule a flag, then everything will be logged and you don't have to care about it again." }-

In Reference to Internet Filtering Layer; There is a such thing as blissful Loggings which I personally consider anything malicious, and stressful Loggings which belongs to an Authorized Service which I’d prefer to be-capable of logging to file but without needing to set “Warning Flag” just to-do the work of “Logging to file”…

-{ Quote: " P.S. Ph33r why don't you register here, your statements are more than welcome! You already spend a lot of time in here... " }-

I have reasons, besides my main goal is Look ‘n’ Stop and since I assist by hostering Look ‘n’ Stop Personal Firewall Forum on Spyblocker I don’t really need to hang elsewhere constantly, and since it’s not a constant thing here why Register? ;)

[MickeyTheMan]

Another thing to remember is that unless your firewall has antiflood enabled which LNS has, logging can in itself be a source of system crash.
Perrsonally, i'm content that LNS effectively blocks and have deactived logging for many rules.

[Ph33r_]

Yes that’s true Software Firewalls can crash due to Massive Loggings; however if the Software Firewall crashes due to Massive Loggings then I’d say either there’s something seriously wrong with your System or that particular product. Because a stable Firewall can withstand as Powerful Massive Attacks without any Safe/Anti Logging Features Enabled…

Look ‘n’ Stop can handle anything you can throw at it without Safe/Anti Logging Features Enabled depending on ones System if it’s poorly maintained… I’ve linked couple of Hi Boxes and set it to Packet me silly 80/100 Packets per Second being Logged to “Log” screen and Logged to file…

Look ‘n’ Stop absorbing it like nothing, no Errors/Crashes/Freezes/Delays of any kind… And these tests I performed was running for hours Non-Stop without any Look ‘n’ Stop problems…

[Patrice]

Hi Ph33r_ or Phant0m!
-{ Quote: " quoting: Ph33r_ link=board=23;threadid=8754;start=0#56964 date=1051372873]I have reasons, besides my main goal is Look ‘n’ Stop and since I assist by hostering Look ‘n’ Stop Personal Firewall Forum on Spyblocker I don’t really need to hang elsewhere constantly, and since it’s not a constant thing here why Register?" }-

Mhh... There's another forum of Look'n'Stop? Is it an official one or not? Funny, I never heard about it yet.

Regards,

Patrice

[Ph33r_]

Frederic and I had been Moderating the Official Forum on Becky’s Board until it went down and then Paul SB offered me spot on his Spyblocker Board to hoster Look ‘n’ Stop Forum, near the same time Paul Wilders offered position on his/this Board to Frederic…

So then it was too late for me to turn down something I already gotten, so I choose to make SB Board my Home…

Anyways, I’d poster u an url to-it but it’ll probably just be slapped with Advertising or something and removed… ;)

[Patrice]

Hi Ph33r_

No problem, I have already found it! ;) You don't need to put the link here... Just give me one word and I'll find it! ;D

It happened to me as well that a link I provided was censored. :'(

Regards,

Patrice

[Pieter_Arntz]

-{ Quote: " quoting: Ph33r_ link=board=23;threadid=8754;start=0#57012 date=1051386594]
Anyways, I’d poster u an url to-it but it’ll probably just be slapped with Advertising or something and removed… ;)
" }-

Phantom,

I honestly think you know us better.
We don´t care where any user of any software gets help, when he needs it. As long as he gets it.
We appreciate you helping out here when you can. Highly appreciated.

Regards,

Pieter

[Paul Wilders]

Hi Phantom,

First and foremost: you are most welcome over here - and your fine LnS support is highly appreciated!

To all: As ever, our adagium has been we are glad and happy in providing space for top notch security software - and LnS is beyond any doubt. There's a condition coming with it though: in order to avoid confusion, we want the software support forum the only official one, as is the case for amongst others the LnS forum over on this board.

regards.

paul

[Patrice]

Hi Paul!

Just a little question (don't hang me for this!): And DCS? Don't they have a second forum at their site? Is this the unofficial one over there? lol

Sorry, but I don't think they call it unofficial...

O.K., I shut up now!! :-X

Best regards!

Patrice

[Paul Wilders]

-{ Quote: " quoting: Patrice link=board=23;threadid=8754;start=15#57027 date=1051389173]
Hi Paul!

Just a little question (don't hang me for this!): And DCS? Don't they have a second forum at their site? Is this the unofficial one over there? lol" }-

Hang you?? What for? ;). As for DCS: the one and only official Open TDS/WormGuard/Port Explorer forums are hosted over here - always have been. The private forums for these DCS apps have been hosted over on their site - for years in a row in the meanwhile, open for those who actually did buy the software.

-{ Quote: "Sorry, but I don't think they call it unofficial..." }-

I do hope not! The distinction as described above (Open vs Private) is a result of decision making from both DCS and us. Both of us are quite happy with it ;)

-{ Quote: "O.K., I shut up now!! :-X" }-

Grin...you can't - I'll bet 30 Greek Drachmes on that one 8)

regards.

paul

[Ph33r_]

I Appreciate that guys, I’ve been here from time to time to assist Frederic tad bit which allows him more free time to be-capable of handling user’s Issues, Questions, and comments E-mails and to Implement new Features and maybe few minutes play-time outside the box with a girl friend or two…

Whether I’m here or elsewhere if someone needs Assistances I don’t mind giving, there’s no competitiveness just because we our both living on different tracks… Me here, you there or you here and me there… where-ever we presently at and assistance is required, Assistances shall be giving. And that’s what’s important… ;D

[Pieter_Arntz]

-{ Quote: " quoting: Forum Admin link=board=23;threadid=8754;start=15#57030 date=1051390070]
Grin...you can't - I'll bet 30 Greek Drachmes on that one 8)

" }-

;D Trying to get rid of some small change, before it´s too late? ;D

[Paul Wilders]

-{ Quote: " quoting: Ph33r_ link=board=23;threadid=8754;start=15#57031 date=1051390201]
I Appreciate that guys, I’ve been here from time to time to assist Frederic tad bit which allows him more free time to be-capable of handling user’s Issues, Questions, and comments E-mails and to Implement new Features and maybe few minutes play-time outside the box with a girl friend or two…" }-

You are doing a fine job, no doubt about that ;)

-{ Quote: "Whether I’m here or elsewhere if someone needs Assistances I don’t mind giving, there’s no competitiveness just because we our both living on different tracks… Me here, you there or you here and me there… where-ever we presently at and assistance is required, Assistances shall be giving. And that’s what’s important… ;D
" }-

Amen to that!

regards,

paul

[Paul Wilders]

-{ Quote: " quoting: Pieter_Arntz link=board=23;threadid=8754;start=15#57032 date=1051390255]
-{ Quote: " quoting: Forum Admin link=board=23;threadid=8754;start=15#57030 date=1051390070] ;D Trying to get rid of some small change, before it´s too late? ;D
" }-

My old granny once told me: "it's never too late!" ;D

regards.

paul" }-

[Patrice]

Hi Paul,
-{ Quote: " quoting: Forum Admin link=board=23;threadid=8754;start=15#57030 date=1051390070]Grin...you can't - I'll bet 30 Greek Drachmes on that one 8)
" }-

You got me! You're right, rather I die than to shut up! ;D O.K. where do I have to pay the 30 Greek Drachmes? LOL :D

Greetings!

Patrice

[Paul Wilders]

-{ Quote: " quoting: Patrice link=board=23;threadid=8754;start=15#57048 date=1051392272]You got me! You're right, rather I die than to shut up! ;D O.K. where do I have to pay the 30 Greek Drachmes? LOL :D" }-

At last! I'll drop you an email as soon as I've opened a new bank account for this 8)

regards,

paul