Method for auditing log event of fire wall, and teaching experimental system

The invention is designed for use in LAN and can reproduce the whole process of producing the log of firewall. The iptables and FWTK produces original log, and cooperates with the sub-class log generating module to generate each sub-class log; with comparing the normal packet filter and application agent rule with its corresponding log, the user can deeply understand the result of rule's setting. The system comprises module for generating and analyzing the normal packet filter, module for generating and analyzing the application agent log, and module for sorting and outputting log.