syslog-ng

JJX · 03-09-2006, 07:50 AM

I have a syslog-ng server for concentratung all my logs (2-3 linux servers). Is any way to specify from which hosts i should concentrate logs??? I dont want everyone to be able to send me logs

thx

cconstantine · 03-09-2006, 09:19 AM

we covered the syslog udp port on the syslog-ng machine with a f/w rule which only allows incoming packets from our network block. This keeps out bogon logs, and prevents someone from DOS'ing you with a flood.

JJX · 03-09-2006, 11:24 AM

i was searching for something built in syslog-ng

may u share the iptables rules??
thx

cconstantine · 03-09-2006, 12:04 PM

iptables -I INPUT (rule_number) -p udp --dport 514 -s (your_net)/(your_mask)

then "-j" to the right chain. In our case "-j ACCEPT" since we have rules at the bottom that drop all packets.

-c