LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 09-17-2009, 01:56 AM   #1
Ammad
Member
 
Registered: Apr 2004
Distribution: redhat 9.0, fc4, redhat as 4
Posts: 517

Rep: Reputation: 31
iptables log file and syslog


Hi,

I have configured iptables to log all traffic. In syslog it is configured to log this to another file, its working fine. but syslog is populating two files "messages and iptables.log" .

Code:
kern.warning                                            /var/log/iptables.log

*.info;mail.none;authpriv.none;cron.none                /var/log/messages
which is making problem for general logs to read and space utilization.


thanks for help.
 
Old 09-17-2009, 02:40 AM   #2
centosboy
Senior Member
 
Registered: May 2009
Location: london
Distribution: centos5
Posts: 1,137

Rep: Reputation: 116Reputation: 116
Quote:
Originally Posted by Ammad View Post
Hi,

I have configured iptables to log all traffic. In syslog it is configured to log this to another file, its working fine. but syslog is populating two files "messages and iptables.log" .

Code:
kern.warning                                            /var/log/iptables.log

*.info;mail.none;authpriv.none;cron.none                /var/log/messages
which is making problem for general logs to read and space utilization.


thanks for help.

im assuming your iptables log level is like

Code:
--log-level warning
so try

Code:
kern.=warning   /var/log/iptables.log
actually i realise this may not be what you want as it logs only kernel warning messages and not higher.

i did reply to a similar previous post..


see here

Code:
http://www.linuxquestions.org/questions/linux-security-4/logging-with-iptables-does-not-work-755577/

Last edited by centosboy; 09-17-2009 at 02:50 AM.
 
Old 09-17-2009, 03:01 AM   #3
Ammad
Member
 
Registered: Apr 2004
Distribution: redhat 9.0, fc4, redhat as 4
Posts: 517

Original Poster
Rep: Reputation: 31
i am using

iptables -A FORWARD -j LOG --log-level 4

and now set this also not solved the problem

kern.=warning /var/log/iptables.log
 
Old 09-17-2009, 03:11 AM   #4
centosboy
Senior Member
 
Registered: May 2009
Location: london
Distribution: centos5
Posts: 1,137

Rep: Reputation: 116Reputation: 116
Quote:
Originally Posted by Ammad View Post
i am using

iptables -A FORWARD -j LOG --log-level 4

and now set this also not solved the problem

kern.=warning /var/log/iptables.log

and restarted the syslog?

i think the only difference in my setup to yours is the order, but i doubt that even matters

Code:
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none;local0.none            /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog

# Send iptables LOGDROPs to /var/log/iptables
kern.=debug                                             /var/log/iptables

# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

# router logs here
local0.*                                                /var/log/02.log

all iptables messages log to either dmesg or /var/log/iptables only.
 
Old 09-17-2009, 03:23 AM   #5
Ammad
Member
 
Registered: Apr 2004
Distribution: redhat 9.0, fc4, redhat as 4
Posts: 517

Original Poster
Rep: Reputation: 31
Yes restarted syslog every time after making changes to syslog.conf but Not solved. when setting up to

kern.=debug

don't logs in /var/log/iptables.log but logs goes to /var/log/messages.

this can be, use of iptable --log-level 4.

so i revert back to

kern.=warning now logging to both files.

thanks
 
Old 09-17-2009, 03:39 AM   #6
centosboy
Senior Member
 
Registered: May 2009
Location: london
Distribution: centos5
Posts: 1,137

Rep: Reputation: 116Reputation: 116
Quote:
Originally Posted by Ammad View Post
Yes restarted syslog every time after making changes to syslog.conf but Not solved. when setting up to

kern.=debug

don't logs in /var/log/iptables.log but logs goes to /var/log/messages.

this can be, use of iptable --log-level 4.

so i revert back to

kern.=warning now logging to both files.

thanks

oh sorry...think you misunderstood.
when i said change to kern.=debug i also meant the log level on iptables.
iptables --log-level 7 which equates to debugging.
Never mind...that would not have solved the problem anyway.
i cant really replicate this problem..
but still looking..
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
log file deletion on AIX syslog Dr_Death_UAE AIX 1 03-15-2009 02:08 PM
Firewall log file, how to make several different log files with IPTables? newtovanilla Linux - Newbie 5 11-28-2008 12:39 PM
getting syslog to write to other file than /var/log/messages c_mitulescu Linux - Enterprise 6 04-02-2008 10:17 AM
IPTABLES AND SYSLOG log-level warning ? bennethos Debian 0 10-11-2004 07:06 AM
iptables, changing log file from /var/log/messages acid2000 Linux - Networking 3 03-11-2003 08:38 PM


All times are GMT -5. The time now is 07:17 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration