[eyunghans]

Thanks for the quick replies sergev and kva.kva... I'm the slow one to reply to this! :)

sergev-
It looks like both Advent's Firewall Analyzer as well Eventia Reporter require a connection directly to the management station... while that isn't an issue the flood of traffic coming into management station is. If we have 40 firewalls externally deployed (they link our offices around the world), about 1600 total users (with alot more actual computers), and all of them are sending usage data/stats back to our main management station, I could only imagine the traffic generated just by the firewalls could be excessive. To boot our management station is sitting in our home office, which has the most network usage statistically speaking. Is there a way to have a localized station somewhere behind each firewall to collect all of the logs instead of having it go all the way back to our main management station thus plugging up the pipe? It seems like both of these products are exactly what we need, we are just really concerned about the amount of bandwidth these transfer logs are going to generate on a daily basis incoming to that management station...

kva.kva,
We are currently using mrtg to graph our bandwidth, but sadly it won't tell us which user is using a BitTorrent client to download the latest Linux iso and sucking up a full T1... :)

Thanks again,
eyunghans