I am working on a site that is using Checkpoint and the Checkpoint logging has a very useful feature that is able to collect logs constantly. You can then search those logs later to see what has happended after the fact. netscreen also supports the same functions when you are using the Netscreen Security Manager.
I am looking for the same feature for Cisco ASA firewalls. I am using Cisco Security Manager 3.1, RME 4.0.5 and a bunch of Open Source tools, but nothing really comes close to this feature. I can't find anything within CSM, it seems to be a configuration tool only.
I am hoping someone else has this experience and can point me towards a Cisco product that has the same function ?