Re: Network flow log consolidation

[Graham Toal <gtoal () UTPA EDU>]

> Speaking of MARS, does anyone know of an open source 
> application for collecting logs off of Cisco IDS modules?  
> MARS wasn't in the budget this year :-)

many years ago when I ran a small ISP and we couldn't afford
the latest Cisco routers with SNMP, we managed to do OK using
the unix (also Windows I think, now) command "expect" to telnet
(or now ssh) in to a router and output any counters etc from
the command line.  Probably something like "show log" I would
imagine.  Since it is really an interactive session it's a
useful trick to set the page size to 0 so that you can output
a lot of information without having to hit space every page.

There's a good O'Reilly book on Expect, but from what I
remember it's quite easy to install and get a trivial program
running by cribbing from the included example scripts so you
may not need the book.


Graham