Firewall logging

Zero187 · 06-01-2009, 12:34 PM

All the shorewall firewall logs are going to /var/log/messages

The file is becoming pretty big filled with a lot of other data as well, I want all the firewall logs to go to a separate file so I can parse them.

I tried looking through the shorewall settings, but I don't think shorewall is doing the logging (I think it's syslogd, or syslog-ng).

How would I redirect the firewall info to /var/log/firewall.log instead of the messages file?

Thanks

repo · 06-01-2009, 12:38 PM

Hi,

Take a look at
http://www.shorewall.net/shorewall_logging.html

Zero187 · 06-01-2009, 01:39 PM

Thank you, got it set up using this:

http://marc.info/?l=gentoo-security&...910563&w=2

Had to change a few things tho and restart the system but it's working good now.

Next step is getting wflogs to parse the file. If you know how to help with that, here is my topic:

http://www.linuxquestions.org/questi...wflogs-729877/

I think wflogs might be trying to connect somewhere and the firewall might be blocking it? Not sure..