[SOLVED] syslog ignore rules not working

denydias · 01-25-2021, 05:50 PM

Quote:

Originally Posted by GazL

Are you sure they're coming from netfilter as kern.warn?

Yes. For two reasons:

My script is netfilter based (i.e. uses iptables/ip6tables to commit rules);
kern.warn -/var/log/firewall has the expected behavior (i.e. only netfilter messages are logged).

I'll open an issue to the upstream project.

But thanks again for you attempt, @GazL! I let you know of further developments on this.

EDIT: upstream issue here.

regdub · 01-25-2021, 09:48 PM

Hi,

I also have noticed confusing changes since sysklogd-2.2.0 upgrade.

I use a configuration for /var/log/messages and /var/log/syslog quite close from slackware stock.

Code:

*.info;*.!warn;\
    authpriv.none;cron.none;mail.none;news.none;daemon.none;auth.none   -/var/log/messages

*.warn;\
    authpriv.none;cron.none;mail.none;news.none;daemon.none;auth.none   -/var/log/syslog

cat /var/log/messages* | grep " kernel:"
gives nothing since the upgrade. All kernel messages arrive now in /var/log/syslog.

My FW is configured with log level "debug", "dmesg -l debug" output the messages as expected but messages also go to /var/log/syslog.

denydias · 01-26-2021, 05:54 PM

Good news!

Upstream has been able to reproduce, isolate and fix sysklogd. A patch is available. New release will come by the weekend.

More details here.

I would like to thanks all the ones who contributed here and @troglobit (sysklogd developer), which is also very nice guy!

EDIT: I just recompiled sysklogd with the provided patch. It works.

regdub · 01-31-2021, 07:36 AM

Thanks denydias

After upgrade to 2.2.1-current, it looks like things got back to normal here too.