Re: Kernel log messages
From: Peter Pentchev (roam@ringlet.net)
Date: 12/14/02
- Next message: Pawel Jakub Dawidek: "Re: OpenSSH's sftp and chroot"
- Previous message: Erwan Breton: "Kernel log messages"
- In reply to: Erwan Breton: "Kernel log messages"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 14 Dec 2002 17:58:53 +0200 From: Peter Pentchev <roam@ringlet.net> To: Erwan Breton <breton@cri.ensmp.fr>
On Sat, Dec 14, 2002 at 12:14:42PM +0100, Erwan Breton wrote:
> Hi,
>
> Since i have activate the firewall on my Box, I have many kernel log
> messages in my security check output every night. the problem is, idon't see
> anymore interessant messages like bad login.
>
> athena kernel log messages:
[snip ipfw log messages]
>
> main# uname -a
> FreeBSD 4.7-STABLE #10: Thu Nov 28 19:00:13 CET 2002
> I just active firewall (i think :o) )
>
> If u need more conf (like syslog.conf) tell it.
>
> Thanks for ideas and answers.
What exactly is the problem: that those messages are hiding the rest of
the information in your logfiles? You can easily turn ipfw logging off:
it is currently logging verbosely because of one of two reasons - either
you have an 'option IPFIREWALL_VERBOSE' in your kernel config file, or
you have 'firewall_logging="yes"' in your /etc/rc.conf file.
To turn ipfw logging off, either remove the firewall_logging="yes" line
from /etc/rc.conf, or add a net.inet.ip.fw.verbose=0 line to
/etc/sysctl.conf. Both of these will take effect upon your next reboot,
when the startup scripts reread the configuration; if you want to turn
off the verbose ipfw logging right now, issue the following command:
sysctl net.inet.ip.fw.verbose=0
Of course, neither of these will help if you have explicitly requested
logging in one of your firewall rules: examine your firewall
configuration and see if any of the rules has the 'log' keyword.
All this said, there is another option for having your cake and eating
it, too: instructing syslog.conf to send ipfw log messages to another
location. According to the ipfw manual page, the 'log' keyword causes
ipfw to send kernel.security syslog messages; you could redirect those
to a separate file, so that they do not interfere with your normal
logging.
Hope this helps :)
G'luck,
Peter
-- Peter Pentchev roam@ringlet.net roam@FreeBSD.org PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 Thit sentence is not self-referential because "thit" is not a word.
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
- application/pgp-signature attachment: stored
- Next message: Pawel Jakub Dawidek: "Re: OpenSSH's sftp and chroot"
- Previous message: Erwan Breton: "Kernel log messages"
- In reply to: Erwan Breton: "Kernel log messages"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
