Syslog entries from PIX appearing is messages log...

ddenton · 02-25-2008, 09:13 AM

Hello forum.

I have an RHEL 4 server acting as a syslog server for a PIX firewall. I've configured my syslog.conf to write firewall log entries to /var/log/firewall. Here's a snip from my syslog.conf:

# Log firewall messages
local4.* /var/log/firewall

Problem is, the entries that appear in /var/log/firewall also appear in /var/log/messages. There are no other "local" entries in syslog.conf, so what could cause the firewall entries to be sent to the firewall and the messages log?

Thanks in advance...

loopy69 · 02-26-2008, 05:27 PM

I have this exact same thing happening and would like to know how to redirect things a little better...

ddenton · 02-29-2008, 10:35 AM

No takers?

Any help is greatly appreciated...

ddenton · 04-08-2008, 11:17 AM

I think I may have figured this out. The facilities listed that will be logged to my /var/log/messages file includes *.info. I'm logging all "info" level entries from my firewall to my appropriate log file, so syslog must be picking up on this and parsing them into the messages log.

At least that's my theory. I'll test and post the results.

ddenton · 04-08-2008, 11:28 AM

That was it. Appending "local4.none" to the facility list for the messages log did the trick.

Code:

*.info;mail.none;authpriv.none;cron.none;local4.none            /var/log/messages