| View previous topic :: View next topic |
| Author |
Message |
Halonix
Tux's lil' helper
Joined: 19 Jul 2003
Posts: 87
|
 Posted: Sat Apr 17, 2004 5:15 pm Post subject: IPTABLES will not log to my log files... |
 |
|
I added IPT in the logging prefixes of all my iptables log chains. And I added the following to my syslog-ng.conf file:
destination firewall { file("/var/log/firewall"); };
filter f_firewall { match("IPT"); };
log { source(src); filter(f_firewall); destination(firewall); };
But I am still getting nothing in /var/log/firewall |
|
| Back to top |
|
 |
Halonix
Tux's lil' helper
Joined: 19 Jul 2003
Posts: 87
|
| Posted: Sat Apr 17, 2004 5:45 pm Post subject: |
|
|
Woo hoo! I figured it out 
I had to change the src in
log { source(src); filter(f_firewall); destination(firewall); };
to kernsrc like so
log { source(kernsrc); filter(f_firewall); destination(firewall); };
good stuff |
|
| Back to top |
|
|
Andersson
Guru
Joined: 12 Jul 2003
Posts: 525
Location: Göteborg, Sweden
|
| Posted: Sat Apr 17, 2004 11:20 pm Post subject: |
|
|
Nice.
How do you get the messages not to appear in kern.log as well? |
|
| Back to top |
|
|
sapphirecat
Guru
Joined: 15 Jan 2003
Posts: 376
|
| Posted: Mon Apr 19, 2004 1:09 am Post subject: |
|
|
| Andersson wrote: | Nice.
How do you get the messages not to appear in kern.log as well? |
Give it the fallback flag like so:
| Code: | log { source(kernsrc); filter(f_iptables); destination(iptables_log); destination(console_all); };
log { source(kernsrc); destination(kern_log); flags(fallback); }; |
And if you're really curious about everything you can make it do, there's some cryptic docs (sort of like a quick reference with a little bit of explanation) lying around in /usr/share/doc/syslog-ng-$VERSION.
_________________
Former Gentoo user; switched to Kubuntu 7.04 when I got sick of waiting on gcc. Chance of thread necro if you reply now approaching 100%... |
|
| Back to top |
|
|
Halonix
Tux's lil' helper
Joined: 19 Jul 2003
Posts: 87
|
| Posted: Tue Apr 20, 2004 10:26 pm Post subject: |
|
|
| The way I did it was by putting a "and not match("IPT")" in the kernel filter line. |
|
| Back to top |
|
|
|
Other Things Gentoo
