LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)
-   -   iptables logs still shows up in dmesg (https://www.linuxquestions.org/questions/linux-networking-3/iptables-logs-still-shows-up-in-dmesg-218829/)

BlueKnight 08-17-2004 12:32 PM

iptables logs still shows up in dmesg
 
Hi,

How can I get iptables to not log the iptables logs, so these show up in dmesg? I have configured syslog.conf like this:

Code:

*.=crit                        /var/log/critical.log
*.=emerg                        /var/log/emergency.log
*.=err                          /var/log/error.log
*.=info;\
        cron.none;\
        kern.none;\
        mail.none;              /var/log/info.log


auth,authpriv.*                /var/log/auth.log
cron.*                          -/var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.=info                      -/var/log/kern.info.log
kern.*;kern.!=info;            -/var/log/kern.log
lpr.*                          -/var/log/lpr.log
mail.*                          -/var/log/mail.log
#news.crit                      /var/log/news/news.crit
#news.err                      /var/log/news/news.err
#news.notice                    -/var/log/news/news.notice
user.*                          -/var/log/user.log
uucp.*                          -/var/log/uucp.log



daemon,mail.*;\
        news.=crit;news.=err;news.=notice;\
        *.=debug;*.=info;\
        *.=notice;*.=warn      /dev/tty8

This is from some example here on LQ, but it should put the iptables into kern.log. This is perfect. However, klogd is still logging all the entries to dmesg. I'm using log-level 3 in iptables and klogd is started with -c 4. Am I still missing something?

Thanks!

BlueKnight 08-23-2004 01:17 AM

Nobody knows this? If you have some kind of idea where to start and what to do, please tell me! Thanks!

BlueKnight 08-30-2004 02:35 AM

Still noone? :( Don't you guys think it is annoying to get all the iptalbes stuff into the /var/log/messages file?

BlueKnight 09-01-2004 07:13 AM

ping

BlueKnight 09-05-2004 03:08 AM

Ok, what about some links to some syslog tutorial or such, so I could get the information myself? I have tried to search for the things I need for such a long time, but without and luck. Please help! Thanks!

DrNeil 09-05-2004 04:17 AM

Re: iptables logs still shows up in dmesg
 
Quote:

Originally posted by BlueKnight
How can I get iptables to not log the iptables logs?
so these show up in dmesg[/QUOTE]

http://lists.hosef.org/pipermail/mon...ne/000230.html
man 8 syslogd man syslog.conf

My syslog.conf and some form of http://www.linuxguruz.com/iptables/s...rewall_023.txt
does that :)

Ill leave the rest to you aka need to attend to grumpy gf :(


Code:

# /etc/syslog.conf - Configuration file for syslogd(8)
#
# For info about the format of this file, see "man syslog.conf".
#

#
#
# print most on tty10 and on the xconsole pipe
#
kern.warn;*.err;authpriv.none        /dev/tty10
kern.warn;*.err;authpriv.none        |/dev/xconsole
*.emerg                                *

# enable this, if you want that root is informed
# immediately, e.g. of logins
#*.alert                                root


#
# all email-messages in one file
#
mail.*                                -/var/log/mail
mail.info                        -/var/log/mail.info
mail.warn                        -/var/log/mail.warn
mail.err                        /var/log/mail.err

#
# all news-messages
#
# these files are rotated and examined by "news.daily"
news.crit                        -/var/log/news/news.crit
news.err                        -/var/log/news/news.err
news.notice                        -/var/log/news/news.notice
# enable this, if you want to keep all news messages
# in one file
#news.*                                -/var/log/news.all

#
# Warnings in one file
#
*.=warn;*.=err                        -/var/log/warn
*.crit                                /var/log/warn

#
# save the rest in one file
#
*.*;mail.none;news.none                -/var/log/messages

#
# enable this, if you want to keep all messages
# in one file
#*.*                                -/var/log/allmessages

#
# Some foreign boot scripts require local7
#
local0,local1.*                        -/var/log/localmessages
local2,local3.*                        -/var/log/localmessages
local4,local5.*                        -/var/log/localmessages
local6,local7.*                        -/var/log/localmessages


:)

DrNeil 09-05-2004 04:19 AM

Just drop the LOG entries in your firewall I suppose ?

BlueKnight 09-07-2004 02:43 AM

DrNeil: Well, this is of course one solution if you wouldn't like to get the logs. Duh!

maxut 09-07-2004 03:11 AM

BlueKnight,
why dont u use an IDS ?
u will have much more log then u want.
www.snort.org
redhat fedora rpms :
http://dag.wieers.com/packages/snort/

good luck

BlueKnight 09-08-2004 04:02 AM

maxut: thanks, but this doesn't solve the problem. However, it would be a great thing to install some kind of IDS, but only after I have everything under control with iptables and logging.

BTW, have you tried any other IDSs?

maxut 09-09-2004 04:23 AM

i didnt try any IDS instead of snort and i just tried snort for test. i have installed it trou rpm packet. snort also logs content of packets. u know iptables can log and can change only header of packets

there is small howto firewall for qmail server (www.qmailrocks.org) including logging. it maybe help u about loggin. check it pls http://www.iptablesrocks.org/

good luck.


All times are GMT -5. The time now is 07:47 PM.