Re: FW: Question about logging.

From: Peter Pentchev (roam_at_ringlet.net)
Date: 05/28/03

  • Next message: Simon L. Nielsen: "Re: FW: Question about logging." 
    Date: Wed, 28 May 2003 23:04:32 +0300
To: "Simon L. Nielsen" <simon@nitro.dk>

    On Wed, May 28, 2003 at 08:36:24PM +0200, Simon L. Nielsen wrote:
    > On 2003.05.28 20:04:28 +0200, Erik Paulsen Sk?lerud wrote:
    >
    > > Yeah, I've gotten that far. But, how can I explicity -only- filter out ipfw
    > > messages from the default console output? Looks like the only way is to
    > > remove kern.debug :(
    >
    > I think you can use something like this in syslog.conf (untested) :
    >
    > !-ipfw
    > *.err;kern.debug;auth.notice;mail.crit /dev/console

    This would match log entries generated by a userland application named
    'ipfw'. The ipfw log lines are, however, generated by the *kernel*, and
    they would never match this rule.

    > Or something along those lines...

    Logging kern.security to a separate file should be enough, I think?
    Never tried it, though.

    > Try looking at syslog.conf(5), it does explain a lot.

    Yep, that too :)

    G'luck,
    Peter 

    -- 
Peter Pentchev	roam@ringlet.net    roam@sbnd.net    roam@FreeBSD.org
PGP key:	http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint	FDBA FD79 C26F 3C51 C95E  DF9E ED18 B68D 1619 4553
This would easier understand fewer had omitted.

  • Next message: Simon L. Nielsen: "Re: FW: Question about logging."

    Relevant Pages

    • Re: FW: Question about logging.
      ... >> This would match log entries generated by a userland application named ... A program specification for `foo' will also match any message logged by ... So, if you have no running program, named "ipfw", which logs to syslogd, ...
      (FreeBSD-Security)
    • Re: ipf / ipfw Which to use?
      ... Ipfilter is multiplatform, ipfw is ... ipfw does not process packets in userland. ...
      (FreeBSD-Security)
    • Re: FW: Question about logging.
      ... > to remove ipfw-logging from the console output is to disable the ... > security messages to the console.. ... So, unless you modify ipfw iteslf, you get to tune your syslogd.conf ...
      (FreeBSD-Security)
    • Re: Best security topology for FreeBSD
      ... ipfw runs in the kernel, but NAT runs in userland. ... With IPFilter this is not so, IPNat runs in the kernel and should be faster. ...
      (FreeBSD-Security)
    • Re: FW: Question about logging.
      ... On 2003.05.28 23:04:32 +0300, Peter Pentchev wrote: ... > This would match log entries generated by a userland application named ... Ehh, I have the following in my syslog.conf, and it works just fine: ...
      (FreeBSD-Security)