@danswartz:
maybe i am misunderstanding you, but why don't you just disable logging due to the default deny rule?
Because then I get essentially no logging. My philosophy (which may be junk from a security perspective) is to gain a familiarity with unwanted inbound traffic. Some of it is common enough (eg, automated MS DS attacks on port 445, SQL attacks, etc) that it clutters the logs. Once I'm comfortable that this traffic is being blocked and is common enough to clutter the logs, I usually create specific denial rules and disable logging it.
This allows me to get a "fresh" view of the log, minus traffic I know is already there but don't want to see, and makes it easier to spot new traffic or more sophisticated unwanted traffic.
Really, it's probably a logfile reporting filter issue more so than a rule issue – ideally you'd still want this traffic logged, but I have yet to see a decent commercial log reporting system that can do this well.
When I worked at one place I had the firewall syslogging to a FreeBSD box and some Perl scripts tied to some really rudimentary web pages that would do this kind of filtering for me (and more, like monthly log summaries that scanned denied traffic and would attempt netblock summarization to try to find patterns in the sources of unwanted traffic). Unfortunately I don't really have the luxury of doing that anymore.
