A system and method is disclosed for collecting, storing and reporting raw
log data from log-producing devices such as firewalls and routers. The
log-producing devices may be both local and remote--i.e., linked to a raw
log server via a LAN and/or a WAN. A log data analyzer at a remote
location gathers log data from devices at that remote location into
time-defined sets and then sends those sets over a WAN (which may be the
Internet) to a raw log server using a first protocol. Local log-producing
devices may send their log data to the log data analyzer via a LAN using
a second protocol. The log data analyzer forwards the raw log data local
devices to an appropriate log data analyzer for parsing, summarizing and
storage in one or more databases. The raw log server combines local and
remote sets of raw log data for a given time period and stores them in a
storage area of raw log data. A central management station is used to
query the various databases in the system and to merge database reports
into a single report for display.
