[syslog-ng]iptables & syslog-ng

[Michael Renner]

On Wed, 29 Aug 2001, Nijs, Daniel wrote:

> Hi Michael
>
> That did indeed fix the problem, are you running 1.5.9?  Now I have to write
> rules for two src's which could cause more overhead, so I would like to know
> if this is a bug of some sort, or normal behavior.  Thanks for your help,
> this really works well.

Hi Daniel!


I'm currently using syslog-ng 1.4.11 because I dont have the time to play
around with the newer versions. The 1.4 branch is stable, and as soon as
1.6 is released i will think about upgrading. There are also a bunch of
new configuration changes which (AFAIK) aren't yet documented in the
online help, and I hate browsing through mailing list archives :).

I never tried getting klogd to work with syslog-ng, because it offered a
native option of getting the kernel messages. But you can put as many
sources as you want in one source-definition, e.g.

source src { unix-stream("/dev/log"); internal(); pipe("/proc/kmsg"); };

should do the trick. That solution was impractical for me, because i would
have to filter much more out of one big stream of data. Now i've got 2
logfiles for the kernel-source, one iptables-log and one for the other
kernel messages.

I think the overhead generated by the two log sources is so small that its
negligible, it's just a bigger config file :)

greetz michael