logging to a different place than kernel ring buffer

logging to a different place than kernel ring buffer

[Marco Moock]

Hello!

I want to log denied traffic, but to syslog or a file rather than the
kernel ring buffer because that messes up the virtual consoles.

What is a good way to achieve that?

-- 
Gruß
Marco

Send unsolicited bulk mail to 1732133134muell@stinkedores.dorfdsl.de

Re: logging to a different place than kernel ring buffer

[Sven-Haegar Koch]

On Wed, 20 Nov 2024, Marco Moock wrote:

> I want to log denied traffic, but to syslog or a file rather than the
> kernel ring buffer because that messes up the virtual consoles.
> 
> What is a good way to achieve that?

Ulogd2

https://www.netfilter.org/projects/ulogd/

c'ya
sven-haegar

-- 
Three may keep a secret, if two of them are dead.
- Ben F.

Re: logging to a different place than kernel ring buffer

[Jordan Dohms]

Alternative to ulogd2, I'd suggest:

Add a 'prefix' to your logging rule(s) and you can build a syslog config off that.
Specify a 'level' in your logging rule(s).
Change the kernel.printk parameter in sysctl to not display the log levels that nft logs to in your console.

Jordan


________________________________________
From: Marco Moock <mm@dorfdsl.de>
Sent: Wednesday, November 20, 2024 3:06 PM
To: netfilter@vger.kernel.org <netfilter@vger.kernel.org>
Subject: logging to a different place than kernel ring buffer
 
Hello!

I want to log denied traffic, but to syslog or a file rather than the
kernel ring buffer because that messes up the virtual consoles.

What is a good way to achieve that?

--
Gruß
Marco

Send unsolicited bulk mail to 1732133134muell@stinkedores.dorfdsl.de

Re: logging to a different place than kernel ring buffer

[Marco Moock]

Am 20.11.2024 um 21:14:07 Uhr schrieb Jordan Dohms:

> Change the kernel.printk parameter in sysctl to not display the log
> levels that nft logs to in your console.

This is what I've done without modifying the log level of the netfilter
rules itself.

Mine are created via firewalld, so I will see if there is a way to
change it there.

-- 
Gruß
Marco

Send unsolicited bulk mail to 1732133647muell@cartoonies.org