iptables logs still shows up in dmesg

BlueKnight · 08-17-2004, 12:32 PM

Hi,

How can I get iptables to not log the iptables logs, so these show up in dmesg? I have configured syslog.conf like this:

Code:

*.=crit                         /var/log/critical.log
*.=emerg                        /var/log/emergency.log
*.=err                          /var/log/error.log
*.=info;\
        cron.none;\
        kern.none;\
        mail.none;              /var/log/info.log


auth,authpriv.*                 /var/log/auth.log
cron.*                          -/var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.=info                      -/var/log/kern.info.log
kern.*;kern.!=info;             -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
#news.crit                      /var/log/news/news.crit
#news.err                       /var/log/news/news.err
#news.notice                    -/var/log/news/news.notice
user.*                          -/var/log/user.log
uucp.*                          -/var/log/uucp.log



daemon,mail.*;\
        news.=crit;news.=err;news.=notice;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       /dev/tty8

This is from some example here on LQ, but it should put the iptables into kern.log. This is perfect. However, klogd is still logging all the entries to dmesg. I'm using log-level 3 in iptables and klogd is started with -c 4. Am I still missing something?

Thanks!

BlueKnight · 08-23-2004, 01:17 AM

Nobody knows this? If you have some kind of idea where to start and what to do, please tell me! Thanks!

BlueKnight · 08-30-2004, 02:35 AM

Still noone?

Don't you guys think it is annoying to get all the iptalbes stuff into the /var/log/messages file?

BlueKnight · 09-01-2004, 07:13 AM

BlueKnight · 09-05-2004, 03:08 AM

Ok, what about some links to some syslog tutorial or such, so I could get the information myself? I have tried to search for the things I need for such a long time, but without and luck. Please help! Thanks!

DrNeil · 09-05-2004, 04:17 AM

Quote:

Originally posted by BlueKnight
How can I get iptables to not log the iptables logs?

so these show up in dmesg[/QUOTE]

http://lists.hosef.org/pipermail/mon...ne/000230.html
man 8 syslogd man syslog.conf

My syslog.conf and some form of http://www.linuxguruz.com/iptables/s...rewall_023.txt
does that

Ill leave the rest to you aka need to attend to grumpy gf

Code:

# /etc/syslog.conf - Configuration file for syslogd(8)
#
# For info about the format of this file, see "man syslog.conf".
#

#
#
# print most on tty10 and on the xconsole pipe
#
kern.warn;*.err;authpriv.none	 /dev/tty10
kern.warn;*.err;authpriv.none	|/dev/xconsole
*.emerg				 *

# enable this, if you want that root is informed
# immediately, e.g. of logins
#*.alert				 root


#
# all email-messages in one file
#
mail.*				-/var/log/mail
mail.info			-/var/log/mail.info
mail.warn			-/var/log/mail.warn
mail.err			 /var/log/mail.err

#
# all news-messages
#
# these files are rotated and examined by "news.daily"
news.crit			-/var/log/news/news.crit
news.err			-/var/log/news/news.err
news.notice			-/var/log/news/news.notice
# enable this, if you want to keep all news messages
# in one file
#news.*				-/var/log/news.all

#
# Warnings in one file
#
*.=warn;*.=err			-/var/log/warn
*.crit				 /var/log/warn

#
# save the rest in one file
#
*.*;mail.none;news.none		-/var/log/messages

#
# enable this, if you want to keep all messages
# in one file
#*.*				-/var/log/allmessages

#
# Some foreign boot scripts require local7
#
local0,local1.*			-/var/log/localmessages
local2,local3.*			-/var/log/localmessages
local4,local5.*			-/var/log/localmessages
local6,local7.*			-/var/log/localmessages

DrNeil · 09-05-2004, 04:19 AM

Just drop the LOG entries in your firewall I suppose ?

BlueKnight · 09-07-2004, 02:43 AM

DrNeil: Well, this is of course one solution if you wouldn't like to get the logs. Duh!

maxut · 09-07-2004, 03:11 AM

BlueKnight,
why dont u use an IDS ?
u will have much more log then u want.
www.snort.org
redhat fedora rpms :
http://dag.wieers.com/packages/snort/

good luck

BlueKnight · 09-08-2004, 04:02 AM

maxut: thanks, but this doesn't solve the problem. However, it would be a great thing to install some kind of IDS, but only after I have everything under control with iptables and logging.

BTW, have you tried any other IDSs?

maxut · 09-09-2004, 04:23 AM

i didnt try any IDS instead of snort and i just tried snort for test. i have installed it trou rpm packet. snort also logs content of packets. u know iptables can log and can change only header of packets

there is small howto firewall for qmail server (www.qmailrocks.org) including logging. it maybe help u about loggin. check it pls http://www.iptablesrocks.org/

good luck.