http://www.ciscopress.com/articles/article.asp?p=424447&seqNum=4

notes about logging and long analyzing on cisco netsec devices (pix/asa)