I'm trying to figure out how I can re-direct all instances of firewall data in my syslog to go to another file...
I want it to send every instance of this type to a file called /var/log/firewall.log
Code:
Nov 27 23:10:14 mugen kernel: firewall: IN=eth0 OUT=MAC=00:80:c8:dd:4b:23:00:09:12:82:70:70:08:00 SRC=60.35.57.61 DST=24.57.127.148 LEN=48 TOS=0x00 PREC=0x00 TTL=106 ID=62203 DF PROTO=TCP SPT=3669 DPT=5554 WINDOW=16384 RES=0x00 SYNURGP=22103
Also, I would like to output my portsentry instances to a file called /var/log/portsentry.log
Code:
Nov 27 05:44:20 mugen portsentry[1524]: attackalert: SYN/Normal scan from host: d57-127-148.home.cgocable.net/24.57.127.148 to TCP port: 620
What would I add to my /etc/syslog.conf to make it do this?
Currently I have a script that runs and grabs all the info and outputs it to those files in my crontab running every 5 mins, but this is not really an idea method.
Thanks for any help you can offer...
