/var/log/messages is useless

puzz_1 · 07-17-2003, 03:28 PM

It doesn't track anything except logins and a few system messages here and there.
I am trying to mount a samba share remotely and I keep getting accesss denied (bcz of ipchains blocking 137-139), where can i see this kinda activity?? any logs or something else??

david_ross · 07-17-2003, 03:30 PM

You can set iptables to log to /var/log/messages

For more details:
man iptables

german · 07-17-2003, 05:59 PM

You could enable kernel messages to console (/etc/sysctl.conf I think), then just type <ctrl><alt><f1> from X to see it, after you create the error in a controlled manner.

HTH

B.

-- oh right but you still have to set it to log in ipchains

enigmasoldier · 07-18-2003, 01:16 PM

/var/log/messages is not useless. It is only as useful as *ahem* it's admin sets it up to be. If it's not how you like it then you are the problem.

A simple solution would be to change the syslog.conf logging parameters to include whatever you want.
http://www.theorygroup.com/Theory/Systems/syslog.html
http://www.die.net/doc/linux/man/man...og.conf.5.html

Always remember, a computer is only as smart as it's user. Never blame the computer when you are the one that is at fault!

I use syslog-ng (due to more fine grained control of logging) but I am sometimes overly paranoid. check it out:
http://www.balabit.com/products/syslog_ng/