putting all logs in a file

putting all logs in a file

[akshaysalkar]

is there anyway i can completely avoid sending netfilter log messages to /var/log/messages

i dont want to clutter up that file

and instead put to /var/log/iptables.log

it seems messages go in both files if i use 
kern.info /var/log/iptables.log
in the /etc/syslog.conf file


i want just in one file ie. /var/log/iptables.log
Get Your Private, Free E-mail from Indiatimes at http://email.indiatimes.com

 Buy The Best In BOOKS at http://www.bestsellers.indiatimes.com

Bid for for Air Tickets on Air Sahara Flights at Prices Lower Than Before. Just log on to http://airsahara.indiatimes.com and Bid Now!

Re: putting all logs in a file

[Stephen Smoogen]

You can change the log level with the --log-level addtion to any -j LOG 
lines

LOG_LEVEL="local1"
-j LOG --log-level ${LOG_LEVEL} --log-prefix " Blah "

Then have local1 in /etc/syslog.conf go to /var/log/iptables.log

On Wed, 10 Sep 2003, akshaysalkar wrote:

>is there anyway i can completely avoid sending netfilter log messages to /var/log/messages
>
>i dont want to clutter up that file
>
>and instead put to /var/log/iptables.log
>
>it seems messages go in both files if i use 
>kern.info /var/log/iptables.log
>in the /etc/syslog.conf file
>
>
>i want just in one file ie. /var/log/iptables.log
>Get Your Private, Free E-mail from Indiatimes at http://email.indiatimes.com
>
> Buy The Best In BOOKS at http://www.bestsellers.indiatimes.com
>
>Bid for for Air Tickets on Air Sahara Flights at Prices Lower Than Before. Just log on to http://airsahara.indiatimes.com and Bid Now!
>
>

-- 
Stephen John Smoogen            smoogen@lanl.gov
Los Alamos National Labrador  CCN-5 Sched 5/40  PH: 5-8058
Ta-03 SM-261  MailStop P208 DP 17U  Los Alamos, NM 87545
-- So shines a good deed in a weary world. = Willy Wonka --

Re: putting all logs in a file

[Jeffrey Laramie]

[-- Attachment #1: Type: text/plain, Size: 527 bytes --]



Stephen Smoogen wrote:

>You can change the log level with the --log-level addtion to any -j LOG 
>lines
>
>LOG_LEVEL="local1"
>-j LOG --log-level ${LOG_LEVEL} --log-prefix " Blah "
>
>Then have local1 in /etc/syslog.conf go to /var/log/iptables.log
>  
>

I also wanted to do this, so I tried it and iptables balked with:

iptables v1.2.7a: log-level 'local1' unknown

I checked my syslog.h file and found that 'local1' was an alias for the 
LOG_LOCAL1 facility and not defined as a priority (log level). Suggestions?

Jeff

[-- Attachment #2: Type: text/html, Size: 924 bytes --]

Re: putting all logs in a file

[Stephen Smoogen]

I am an idiot.. sorry.. The log-level covers items like 

emerg
alert
crit
err
warning
notice
info
debug

It should be use something like info and then put a line in syslog.conf
for 

kern.info /var/log/iptables

My apologies for the early morning stupidity.



On Wed, 2003-09-10 at 09:11, Jeffrey Laramie wrote:
> 
> Stephen Smoogen wrote:
> > You can change the log level with the --log-level addtion to any -j LOG 
> > lines
> > 
> > LOG_LEVEL="local1"
> > -j LOG --log-level ${LOG_LEVEL} --log-prefix " Blah "
> > 
> > Then have local1 in /etc/syslog.conf go to /var/log/iptables.log
> >   
> 
> I also wanted to do this, so I tried it and iptables balked with:
> 
> iptables v1.2.7a: log-level 'local1' unknown
> 
> I checked my syslog.h file and found that 'local1' was an alias for
> the LOG_LOCAL1 facility and not defined as a priority (log level).
> Suggestions?
> 
> Jeff
-- 
Stephen John Smoogen		smoogen@lanl.gov
Los Alamos National Labrador  CCN-5 Sched 5/40  PH: 4-0645 (note new #)
Ta-03 SM-1498 MailStop B255 DP 10S  Los Alamos, NM 87545
-- So shines a good deed in a weary world. = Willy Wonka --

Re: putting all logs in a file

[Jeffrey Laramie]

[-- Attachment #1: Type: text/plain, Size: 1671 bytes --]


>It should be use something like info and then put a line in syslog.conf
>for 
>
>kern.info /var/log/iptables
>

Ahhh, but this is the command he started with, and it logs to both files 
by default. I've wanted to do this for some time so I did a little 
hacking of syslog.conf file and here's what I've got so far:

1.   Log level "info" is used by the kernel pretty regularly, so I 
changed my iptables log levels to "debug". Since every kernel message 
with a log level of debug will show up in this file, I selected a log 
level that my system rarely uses. Your mileage may vary.

iptables . . .   -j LOG --log-level debug --log-prefix "your_prefix:"

2.   Add a statement in your syslog.conf file:

kern.=debug      -/var/log/iptables.log

This will send only kernel debug level messages to your file. If you 
don't use the "=" then all messages at debug level or higher 
(everything) will go to your file. The "-" before the log file name 
allows the system to delay logging to this file during times of heavy 
kernel load.

3.   Modify the syslog.conf line that points to your /var/log/messages 
file by adding "kern.!=debug" to exclude (only) debug messages. In my 
case the line now looks like this:

*.*;mail.none;news.none;kern.!=debug      -/var/log/messages

4.    Restart syslog (this may not be necessary but it's a quick way to 
see if thing are going where you expected) and reload your iptables rules.

>My apologies for the early morning stupidity.
>  
>

I've found another cup of coffee often relieves this condition  ;-)   
I'm not much of a script writer on a good day (after coffee) so I 
welcome any suggested corrections or improvements.

Jeff

[-- Attachment #2: Type: text/html, Size: 2357 bytes --]