iptables log file and syslog

Ammad · 09-17-2009, 01:56 AM

Hi,

I have configured iptables to log all traffic. In syslog it is configured to log this to another file, its working fine. but syslog is populating two files "messages and iptables.log" .

Code:

kern.warning                                            /var/log/iptables.log

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

which is making problem for general logs to read and space utilization.

thanks for help.

centosboy · 09-17-2009, 02:40 AM

Quote:

Originally Posted by Ammad

Hi,

I have configured iptables to log all traffic. In syslog it is configured to log this to another file, its working fine. but syslog is populating two files "messages and iptables.log" .

Code:

kern.warning                                            /var/log/iptables.log

*.info;mail.none;authpriv.none;cron.none                /var/log/messages

which is making problem for general logs to read and space utilization.

thanks for help.

im assuming your iptables log level is like

Code:

--log-level warning

so try

Code:

kern.=warning   /var/log/iptables.log

actually i realise this may not be what you want as it logs only kernel warning messages and not higher.

i did reply to a similar previous post..

see here

Code:

http://www.linuxquestions.org/questions/linux-security-4/logging-with-iptables-does-not-work-755577/

Ammad · 09-17-2009, 03:01 AM

i am using

iptables -A FORWARD -j LOG --log-level 4

and now set this also not solved the problem

kern.=warning /var/log/iptables.log

centosboy · 09-17-2009, 03:11 AM

Quote:

Originally Posted by Ammad

i am using

iptables -A FORWARD -j LOG --log-level 4

and now set this also not solved the problem

kern.=warning /var/log/iptables.log

and restarted the syslog?

i think the only difference in my setup to yours is the order, but i doubt that even matters

Code:

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none;local0.none            /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Send iptables LOGDROPs to /var/log/iptables
kern.=debug                                             /var/log/iptables

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

# router logs here
local0.*                                                /var/log/02.log

all iptables messages log to either dmesg or /var/log/iptables only.

Ammad · 09-17-2009, 03:23 AM

Yes restarted syslog every time after making changes to syslog.conf but Not solved. when setting up to

kern.=debug

don't logs in /var/log/iptables.log but logs goes to /var/log/messages.

this can be, use of iptable --log-level 4.

so i revert back to

kern.=warning now logging to both files.

thanks

centosboy · 09-17-2009, 03:39 AM

Quote:

Originally Posted by Ammad

Yes restarted syslog every time after making changes to syslog.conf but Not solved. when setting up to

kern.=debug

don't logs in /var/log/iptables.log but logs goes to /var/log/messages.

this can be, use of iptable --log-level 4.

so i revert back to

kern.=warning now logging to both files.

thanks

oh sorry...think you misunderstood.
when i said change to kern.=debug i also meant the log level on iptables.
iptables --log-level 7 which equates to debugging.
Never mind...that would not have solved the problem anyway.
i cant really replicate this problem..
but still looking..