| View previous topic :: View next topic |
| Author |
Message |
xante
Apprentice
Joined: 23 Aug 2004
Posts: 229
|
 Posted: Sun Feb 05, 2006 2:54 am Post subject: {Solved} Shorewall massive logs. |
 |
|
Shorewall does output quite a bit of a log after a couple hours, in a day of logging my log came close to 4 gigs. I think thats a bit excessive but I cant quite figure out how to lower the log level. I changed all Log level entries I could find in both /etc/shorewall/shorewall.conf and /etc/shorewall/policy to emerg and yet /var/log/messages still recieves an excessive amount of logs (and watching /dev/tty12 the text scrolls by extremely quick), Im using syslog-ng and can disable logging to /var/log/messages but this isnt what I want. I just want there to be fewer logs all around. Thank you for your time.
Last edited by xante on Sat Feb 18, 2006 12:35 pm; edited 1 time in total |
|
| Back to top |
|
 |
jpl888
Guru
Joined: 13 Apr 2005
Posts: 337
Location: Piltown, Co. Kilkenny, Ireland.
|
| Posted: Sun Feb 05, 2006 8:30 am Post subject: |
|
|
| You can set logging levels based on your rules and policies. Is it possible you have logging enabled on all rules and policies thus the excessive logging? |
|
| Back to top |
|
|
magic919
Advocate
Joined: 17 Jun 2005
Posts: 2182
Location: Berkshire, UK
|
| Posted: Sun Feb 05, 2006 9:23 am Post subject: |
|
|
Set up filters in syslog-ng to rid your logs of the unwanted stuff. It will stop certain bits from hitting the logs.
Like for mail I use
| Code: |
destination mail { file("/var/log/maillog" perm(0644) ); };
filter f_mail { facility(mail) and not match (Login); };
log { source(src); filter(f_mail); destination(mail); };
|
That means I get the stuff Postfix is up to and my anti-spam but not POP and IMAP logins. |
|
| Back to top |
|
|
xante
Apprentice
Joined: 23 Aug 2004
Posts: 229
|
| Posted: Tue Feb 07, 2006 5:39 am Post subject: |
|
|
| You were correct in sayng that filters would fix the problem, I copied and pasted the default off of the gentoo security page and it was working fine, little be known to me, when I was editing some of the syslog-ng.conf file, parts I didnt need, I removed the filtering section all together. Thank you for your help. |
|
| Back to top |
|
|
|
Networking & Security
