Hi,

Whether I use ufw or firestarter to populate my iptables, my firewall logs get written to 3 different log files:
/var/log/messages
/var/log/kern.log
/var/log/syslog
I want to keep the logging turned on, but I'd rather it not log to syslog, as it's obscuring other events in syslog that I'd like to see. I'm using rsyslog on Ubuntu. I looked around online and found one person suggesting I add this to the top of rsyslog.conf:

kern.* -/var/log/kern.log
kern.* ~

I did that and restarted rsyslog, but it's still logging to the same 3 files. Can anyone help?

Thanks!

Wouldn't that be handled by ulogd and ulogd.conf respectively?

http://linux.die.net/man/8/ulogd

I don't have ulogd. What handles the logging is rsyslogd and rsyslog.conf.

I find no reason to remove this from syslog.

If the disk utlization is the problem for you, you can use logrotate utlitiy.

Get back if you need more details on that or rather you can try google-ing it.

I do use logrotate. The problem is that there are so many entries that they obscure other entries that I would like to be more visible. Also, I don't really see the point of putting them into three different log files, especially when there is a high potential volume.