I think the problem may be that as iptables logs under the KERN facility, the iptables logs are being directed to /var/log/messages with all of the other kernel logs. It's not a certainty, I'm taking this information from a post on the debian security list. I guess you could either just apply the f_niptab filter to the /var/log/messages destination (which i assume that you have omitted here) or just create another filter that drops all kernel messages to /var/log/messages. Of course I may just be making a complete fool out of myself. Anyone care to correct/elaborate/expand/flame? mark On Thu, Aug 12, 2004 at 01:33:38PM -0500, Anoop Rajendra wrote:
I need to log all messages from iptables, ipmasq to a particular file (say iptables.log) and to that only and nothing else. Is there a way to specifically define this, ie say that messages from this daemon should go nowhere else? i've tried -
# IPMasq Messages destination ipmasq { file("/var/log/iptables.log" owner("root") group("adm") perm(0640)); };
filter f_iptables( match("iptables"); ); filter fn_iptables( not match("iptables"); );
log { source(src); filter(f_authpriv); filter(fn_iptab); destination(authlog); }; log { source(src); filter(f_syslog); filter(fn_iptab); destination(syslog); }; log { source(src); filter(f_daemon); filter(fn_iptab); destination(daemon); }; log { source(src); filter(f_kern); filter(fn_iptab); destination(kern); }; log { source(src); filter(f_lpr); filter(fn_iptab); destination(lpr); }; log { source(src); filter(f_mail); filter(fn_iptab); destination(mail); }; log { source(src); filter(f_user); filter(fn_iptab); destination(user); }; log { source(src); filter(f_uucp); filter(fn_iptab); destination(uucp); };
log { source(src); filter(f_iptab); destination(ipmasq); };
Yet all the IPMasq messages are passed top both iptables.log and /var/log/messages.
All IPMasq messages are prefixed with the string "iptables" using --log-prefix iptables
What am I doing wrong?
Thanks, Anoop /// ________________________________________________ Everybody has something to conceal. -- Humphrey Bogart
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html