FWAnalog is a shell script that parses and summarizes firewall log files. It currently understands logs from IPF (tested with OpenBSD 2.8 and 2.9's IPF, also FreeBSD and NetBSD), Linux 2.2 IPChains and Linux 2.4 IPTables. It has been tested on Debian GNU/Linux "sid" with bash and OpenBSD 2.8 and 2.9 with ksh as /bin/sh.
It can be easily extended for other log file formats; all it takes is editing two regular expressions.
FWAnalog uses the excellent log analysis program Analog (also free software) to create its reports. It does so by converting the firewall log into a fake web server log and calling Analog with a modified configuration.
