iptables log question

silentwisdom · 06-05-2002, 01:58 AM

In my iptables script i have on written a log option on all forwarded traffic but i'm curious were the hell that log is written, because i can't find it.
The rule i've wrote is:

$IPTABLES -A Forward -j LOG

The other parts of my script are working fine but for safety i want the forward rule to be logged.
Can someone tell me were those logs are or what i'm doing wrong?

GREETZZ

Silentwisdom

Noerr · 06-05-2002, 03:26 AM

it is suppose to be written in syslog
you may specify --log-prefix "IPTABLES log:"

you'll be able to find it easily

Noerr · 06-05-2002, 03:27 AM

ohh
i forgot
you need to check /etc/syslog.conf to make sure that kernel logging in turned on

regards

silentwisdom · 06-05-2002, 08:30 AM

is thjis the lane for kernel logging?
because it was commented out
It was
#*.kern /dev/console

i made it
*.kern /var/log/messages
Is the traffic now logged into messages in the var/log directory????

GREEEETZZZZZZZ
Silentwisdom

silentwisdom · 06-05-2002, 08:31 AM

made a mistake In the post
It must be
kern.*
instead of
*.kern

TruckStuff · 06-05-2002, 08:42 AM

No that is not it. You need to add a line to the syslog.conf file that reads something like this:

kern.warn /var/log/messages

You also need to be sure that the logging statement is high enough in the chain that it actually gets executed. For instance if you drop all forwarded packets before this statement, the logging is never done.

silentwisdom · 06-05-2002, 08:54 AM

Now i've putted my log rule before the declaration of my default policie in the chain.
And i've changed my sylog.conf file
But i still get nothing in my messages

:-(

Noerr · 06-05-2002, 04:08 PM

1.) restart syslog
modify line in sylog like this
*.info;mail.none;authpriv.none;cron.none;kern.* /var/log/messages

and it will work fine.
But you might have log statement at the wrong place like Truckstuff suggested
read www.iptables.com howtos,

silentwisdom · 06-06-2002, 11:43 AM

I still don't get it working Were must i put the log statement?
Before the default policie ar after it?????
I had it working once but my logs got to big so i killed it.