Fastvue-a-like

[synaesthesia]

Right, we're getting really annoyed with XG's inability to collate it's reports in a meaningful manner, yet we can't afford Fastvue to do a proper job of it for us.However, it strikes me that as all Fastvue does is poll for 1 syslog event for web filtering, it shouldn't be too difficult to collate that information together to present our DSL with a palatable report that doesn't need as much deciphering by us.

 

So from the XG point of view, it annoyingly means setting up a scheduled report for a good 15-20 categories to cover all eventualities, as it can't group categories (grrrr) and they're not interested in adding that, but having all those reports is just not the way to go. However, doing it via syslog is easier, we have a large log file then which needs to be collated. Shouldn't need much, strip out all the unnecessaries leaving only vital information - date, time, IP address, username, URL, category etc. Collate all information so "Adult Websites" "Sexually Explicit" etc are grouped together for an "Adult" super-category, "weapons" "extremism" etc grouped for PREVENT etc - you get my drift, and strip out URLs with "cdn" in them to get rid of the majority of fluff.

 

I've tried a few parsers, the most promising was Microsoft's own log parser but damnit, it doesn't do syslog correctly, only CSV, TSV etc and throws a wobbly when it comes to spacing.

Eventia, Log Parser Lizard were others that couldn't cut the mustard either. We thought we had a breakthrough with PowerBI but it seems a little beyond our ability!

 

Has anyone ever tackled something like this, or happens to be a whiz that can point us the right direction please? This solution of course would be shared with the community here as quite a few complain about Sophos' reporting; whilst compliant, isn't correct.

[MYK-IT]

We use SonicWALL, and going by what you and others have posted regarding Sopos XG's built-in reporting, its just as dire. That's why we have and use FastVue Reporting in addition.

 

We would be totally lost without it. The GUI, simple to configure (but detailed reporting) and not forgetting the real-time alerting. Our DSL gets automated email alerts and schduled reporting (FastVue now has DSL / HR Dept. level reporting).

No idea of cost, as was bundled with our SonicWALL appliances.

 

FastVue have their own, free SYSLOG https://www.fastvue.co/syslog/ not sure if this helps towards what you are trying to achieve???

Edited October 7, 2019 by MYK-IT

[synaesthesia]

Cheers, yeah tried that But appears to just be a standard syslog service with no ability to export. Ideally want something that can be automated.

[nathan]

Haven't used it before, but what about something like;

 

LOGalyze - Open Source Log Management Tool, SIEM, Log Analyzer

[nathan]

Or could you hack a PHP script together to receive the logs and store in a database?

 

There are classes available: https://www.phpclasses.org/browse/file/12157.html

[synaesthesia]

Just about to hit a breakthrough I think with NetXMS

[nathan]

Just about to hit a breakthrough I think with NetXMS

 

Looks interesting, fairly similar to Zabbix.

Edited October 8, 2019 by nathan