You could set up Splunk to pull all your logs together, calculate bandwidth, and then make email alerts for when you hit various thresholds. It might help to f

You could set up Splunk to pull all your logs together, calculate bandwidth, and then make email alerts for when you hit various thresholds. It might help to firewall out BOGOB IPs and known malicious IPs. These lists have to be actively maintained on the firewall. mod_qos prevents some abuse: http://opensource.adnovum.ch/mod_qos/ http://opensource.adnovum.ch/mod_qos/