SOLVED: Re: IPMON log to syslog doesn't work
mexas at bristol.ac.uk
Wed Feb 27 12:55:15 UTC 2008
On Tue, Feb 26, 2008 at 06:26:22PM +0100, Mel wrote:
> On Tuesday 26 February 2008 17:31:27 Anton Shterenlikht wrote:
> > On Tue, Feb 26, 2008 at 03:01:13PM +0000, Anton Shterenlikht wrote:
> > > On Tue, Feb 26, 2008 at 03:42:51PM +0100, Mel wrote:
> > > > On Tuesday 26 February 2008 15:25:37 Anton Shterenlikht wrote:
> > > > > On Tue, Feb 26, 2008 at 03:09:14PM +0100, Mel wrote:
> > > > > > On Tuesday 26 February 2008 14:20:32 Anton Shterenlikht wrote:
> > > > > > > I'm trying to troubleshoot my ipfilter firewall, and I cannot get
> > > > > > > any log data, i.e. /var/log/ipfilter.log is empty.
> > I solved it following the IPF FAQ:
> > http://www.phildev.net/ipf/IPFipmon.html#ipmon1
> > Q. I have IPMon logging to syslog, but syslog doesn't
> > log anything, why not?
> > A. IPF logs as local0 so you'll want something to the effect of:
> > local0.debug /var/log/ipf.log in your syslog.conf.
> > NOTE: There has to be atleast one TAB in that line, not just spaces.
> > so I changed "security.*" to "local0.*" in /etc/syslog.conf:
> > # grep local0 /etc/syslog.conf
> > local0.* /var/log/ipfilter.log
> > #
> > and now I have (lots) of logs in the log file:
> > # tail -2 /var/log/ipfilter.log
> > Feb 26 16:20:05 mech-cluster238 ipmon: 16:20:05.248083 2x dc0 @0:20
> > b 137 .222.187.85,137 -> 126.96.36.199,137 PR udp len 20 78 IN broadcast
> > Feb 26 16:20:07 mech-cluster238 ipmon: 16:20:06.876597 dc0 @0:21 b
> > 137.22 2.187.10,138 -> 188.8.131.52,138 PR udp len 20 212 IN broadcast #
> > # ls -al /var/log/ipfilter.log
> > -rw-r----- 1 root wheel 74889 26 Feb 16:21 /var/log/ipfilter.log
> > #
> > But now I wonder if the FBSD handbook has an error in section
> > 28.5.7 IPMON Logging:
> > "Add the following statement to /etc/syslog.conf:
> > security.* /var/log/ipfilter.log
> > The security.* means to write all the logged
> > messages to the coded file"
> > Shall I submit this as a manual error, or is it more complex?
> I was just looking at that. The weird thing is the following:
> #ifndef LOGFAC
> #define LOGFAC LOG_LOCAL0
> In the contrib/ipfilter/Makefile it is set to security, but...freebsd builds
> with src/sbin/ipf/ipmon and there it is indeed LOG_LOCAL0.
> So either you could request docfix or Makefile fix. There's probably a reason
> why it's set hardcoded like that to LOG_LOCAL0.
I reported this handbook error to the freebsd-doc list.
I also noted that the ipmon man page does say that the default facility
is local0, but it can be changed with -L <facility>. I tried this but
it doesn't seem to work:
# ps ax|grep ipmon
27199 ?? Ss 0:00.11 /sbin/ipmon -sDn -L security
27245 p0 R+ 0:00.01 grep ipmon
so it is working, but no new messages appear in the log. With local0
I get several messages a minute.
Room 2.6, Queen's Building
Mech Eng Dept
University Walk, Bristol BS8 1TR, UK
Tel: +44 (0)117 928 8233
Fax: +44 (0)117 929 4423
More information about the freebsd-questions