grep in syslog.conf

komo · 11-15-2005, 12:27 AM

i wonder, is it possible to use grep in the /etc/syslog.conf file like this:
kern.=info | grep IPTABLES -/var/log/iptables

if it's not possible, is there some way around to do the task to log ONLY the kernel info that include "IPTABLES" string???

Any help will be much appeciated. Thanks.

Que_273 · 11-15-2005, 03:27 PM

I've wanted the same thing for a bit. I've heard that syslog-ng (next generation) daemon has regex capabilites, enabling you to sort messages by content, but I haven't set anything up yet. I might post an example setup if I get one working.

Hoping this helps to put you on the right path...

Que_273 · 11-16-2005, 04:56 AM

It's actually very simple to set up.
The default configuration is set up to be the same as (the old) syslog and these are the extra rules I added.

Code:

destination df_iptables { file("/var/log/iptables"); };

filter f_iptables { match(".*IPTABLES.*"); };

log {
  source(s_all);
  filter(f_iptables);
  destination(df_iptables);
  flags(final);
}

This last rule needs to be put BEFORE the "syslog" one as the "final" flag prevents the iptables logs going into syslog. Useful if you have a lot of them.