LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 08-17-2004, 12:32 PM   #1
BlueKnight
Member
 
Registered: Jul 2004
Distribution: Slackware
Posts: 32

Rep: Reputation: 15
Question iptables logs still shows up in dmesg


Hi,

How can I get iptables to not log the iptables logs, so these show up in dmesg? I have configured syslog.conf like this:

Code:
*.=crit                         /var/log/critical.log
*.=emerg                        /var/log/emergency.log
*.=err                          /var/log/error.log
*.=info;\
        cron.none;\
        kern.none;\
        mail.none;              /var/log/info.log


auth,authpriv.*                 /var/log/auth.log
cron.*                          -/var/log/cron.log
daemon.*                        -/var/log/daemon.log
kern.=info                      -/var/log/kern.info.log
kern.*;kern.!=info;             -/var/log/kern.log
lpr.*                           -/var/log/lpr.log
mail.*                          -/var/log/mail.log
#news.crit                      /var/log/news/news.crit
#news.err                       /var/log/news/news.err
#news.notice                    -/var/log/news/news.notice
user.*                          -/var/log/user.log
uucp.*                          -/var/log/uucp.log



daemon,mail.*;\
        news.=crit;news.=err;news.=notice;\
        *.=debug;*.=info;\
        *.=notice;*.=warn       /dev/tty8
This is from some example here on LQ, but it should put the iptables into kern.log. This is perfect. However, klogd is still logging all the entries to dmesg. I'm using log-level 3 in iptables and klogd is started with -c 4. Am I still missing something?

Thanks!
 
Old 08-23-2004, 01:17 AM   #2
BlueKnight
Member
 
Registered: Jul 2004
Distribution: Slackware
Posts: 32

Original Poster
Rep: Reputation: 15
Nobody knows this? If you have some kind of idea where to start and what to do, please tell me! Thanks!
 
Old 08-30-2004, 02:35 AM   #3
BlueKnight
Member
 
Registered: Jul 2004
Distribution: Slackware
Posts: 32

Original Poster
Rep: Reputation: 15
Still noone? Don't you guys think it is annoying to get all the iptalbes stuff into the /var/log/messages file?
 
Old 09-01-2004, 07:13 AM   #4
BlueKnight
Member
 
Registered: Jul 2004
Distribution: Slackware
Posts: 32

Original Poster
Rep: Reputation: 15
ping
 
Old 09-05-2004, 03:08 AM   #5
BlueKnight
Member
 
Registered: Jul 2004
Distribution: Slackware
Posts: 32

Original Poster
Rep: Reputation: 15
Ok, what about some links to some syslog tutorial or such, so I could get the information myself? I have tried to search for the things I need for such a long time, but without and luck. Please help! Thanks!
 
Old 09-05-2004, 04:17 AM   #6
DrNeil
Member
 
Registered: Aug 2004
Location: Scotland
Distribution: Debian, Suse, Knoppix, Dyna:bolic, Mandrake [couple of years ago], Slackware [1993 or so]
Posts: 150

Rep: Reputation: 15
Re: iptables logs still shows up in dmesg

Quote:
Originally posted by BlueKnight
How can I get iptables to not log the iptables logs?
so these show up in dmesg[/QUOTE]

http://lists.hosef.org/pipermail/mon...ne/000230.html
man 8 syslogd man syslog.conf

My syslog.conf and some form of http://www.linuxguruz.com/iptables/s...rewall_023.txt
does that

Ill leave the rest to you aka need to attend to grumpy gf


Code:
# /etc/syslog.conf - Configuration file for syslogd(8)
#
# For info about the format of this file, see "man syslog.conf".
#

#
#
# print most on tty10 and on the xconsole pipe
#
kern.warn;*.err;authpriv.none	 /dev/tty10
kern.warn;*.err;authpriv.none	|/dev/xconsole
*.emerg				 *

# enable this, if you want that root is informed
# immediately, e.g. of logins
#*.alert				 root


#
# all email-messages in one file
#
mail.*				-/var/log/mail
mail.info			-/var/log/mail.info
mail.warn			-/var/log/mail.warn
mail.err			 /var/log/mail.err

#
# all news-messages
#
# these files are rotated and examined by "news.daily"
news.crit			-/var/log/news/news.crit
news.err			-/var/log/news/news.err
news.notice			-/var/log/news/news.notice
# enable this, if you want to keep all news messages
# in one file
#news.*				-/var/log/news.all

#
# Warnings in one file
#
*.=warn;*.=err			-/var/log/warn
*.crit				 /var/log/warn

#
# save the rest in one file
#
*.*;mail.none;news.none		-/var/log/messages

#
# enable this, if you want to keep all messages
# in one file
#*.*				-/var/log/allmessages

#
# Some foreign boot scripts require local7
#
local0,local1.*			-/var/log/localmessages
local2,local3.*			-/var/log/localmessages
local4,local5.*			-/var/log/localmessages
local6,local7.*			-/var/log/localmessages

 
Old 09-05-2004, 04:19 AM   #7
DrNeil
Member
 
Registered: Aug 2004
Location: Scotland
Distribution: Debian, Suse, Knoppix, Dyna:bolic, Mandrake [couple of years ago], Slackware [1993 or so]
Posts: 150

Rep: Reputation: 15
Just drop the LOG entries in your firewall I suppose ?
 
Old 09-07-2004, 02:43 AM   #8
BlueKnight
Member
 
Registered: Jul 2004
Distribution: Slackware
Posts: 32

Original Poster
Rep: Reputation: 15
DrNeil: Well, this is of course one solution if you wouldn't like to get the logs. Duh!
 
Old 09-07-2004, 03:11 AM   #9
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
BlueKnight,
why dont u use an IDS ?
u will have much more log then u want.
www.snort.org
redhat fedora rpms :
http://dag.wieers.com/packages/snort/

good luck
 
Old 09-08-2004, 04:02 AM   #10
BlueKnight
Member
 
Registered: Jul 2004
Distribution: Slackware
Posts: 32

Original Poster
Rep: Reputation: 15
maxut: thanks, but this doesn't solve the problem. However, it would be a great thing to install some kind of IDS, but only after I have everything under control with iptables and logging.

BTW, have you tried any other IDSs?
 
Old 09-09-2004, 04:23 AM   #11
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
i didnt try any IDS instead of snort and i just tried snort for test. i have installed it trou rpm packet. snort also logs content of packets. u know iptables can log and can change only header of packets

there is small howto firewall for qmail server (www.qmailrocks.org) including logging. it maybe help u about loggin. check it pls http://www.iptablesrocks.org/

good luck.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
/var/log/messages is empty, and also dmesg shows nothing beagle2 Linux - General 5 11-08-2005 08:12 AM
iptables and dmesg boozer_2 Linux - Newbie 4 03-09-2005 06:33 PM
iptables logs ddaas Linux - Security 1 01-20-2005 08:26 AM
iptables firewall seems to work but strange output in dmesg. ldp Linux - Networking 3 04-17-2004 02:00 PM
boot message and dmesg and logs aus9 Slackware 4 01-28-2004 01:27 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 09:23 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration