I have set centralized Syslog (centOS + rsys) server which runs LogAnalyzer for better log presentation. Recently I have got asked to provide logs from the firewall of all IPs for particular firewall statement and count number how many particular IP occurred on the list.
So far I know how to display all logs for particular firewall statement, but no clue how to retrieve source IP from the message column and count particular IP occurrence.
Is there any additional software which can do that or I need to create own log parser to get this done?
Thanks