Logging via an external syslog utility is common and gives vendors a simple way to integrate logging into an existing network. Logging on the firewall is useful for realtime troubleshooting, but getting the information from the firewall for historical analysis is difficult. If security logging can't be captured to an external file, you'll have adifficult time managing your security. No level of automated filtering cantake the place of log analysis done by administrators because concentratedattacks take place over time. To catch a port scan in progress, you'll need to trap that information and be on the console as it's happening.
Some vendors offer products that log security events to a telnet console.
They'll tell you to leave a telnet session running and capture the screen to a local file. While this does provide logging of a sort, it also leaves that management session open to anyone with access to the workstation running the telnet client. It also could result in having the telnet session disconnected in a DoS attack. Hackers typically attack when the office is closed and the attack would go unnoticed. A firewall appliance with alerting features lets you take swift action in the event of an attack.