Date: Sat, 11 Mar 2000 12:41:19 -0500 From: "Crist J. Clark" <cjc@cc942873-a.ewndsr1.nj.home.com> To: Terry Todd <tlt@tltodd.com> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: ipfw logging Message-ID: <20000311124118.C23514@cc942873-a.ewndsr1.nj.home.com> In-Reply-To: <200003111405.IAA00763@tltodd.com>; from tlt@tltodd.com on Sat, Mar 11, 2000 at 08:05:58AM -0600 References: <200003111405.IAA00763@tltodd.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Mar 11, 2000 at 08:05:58AM -0600, Terry Todd wrote:
>
> If I turn on IPFIREWALL_VERBOSE I get ipfw logging to log to the
> console and /var/log/messages and /var/log/ipfw.log. If I turn
> off IPFIREWALL_VERBOSE I get no logging at all. How can I set it
> up to log only to /var/log/ipfw.log?
>
> TIA,
> Terry Todd
>
> My syslog.conf file is as follows:
> # $Id: syslog.conf,v 1.9 1998/10/14 21:59:55 nate Exp $
> #
> # Spaces are NOT valid field separators in this file.
> # Consult the syslog.conf(5) manpage.
> *.err;kern.debug;auth.notice;mail.crit /dev/console
^^^^^^^^^^
> *.notice;kern.debug;lpr.info;mail.crit;news.err /var/log/messages
^^^^^^^^^^
> mail.info /var/log/maillog
> lpr.info /var/log/lpd-errs
> ftp.* /var/log/ftp.log
> cron.* /var/cron/log
> *.err root
> *.notice;news.err root
> *.alert root
> *.emerg *
> # uncomment these if you're running inn
> # news.crit /var/log/news/news.crit
> # news.err /var/log/news/news.err
> # news.notice /var/log/news/news.notice
> !startslip
> *.* /var/log/slip.log
> !ppp
> *.* /var/log/ppp.log
> !pppd
> *.* /var/log/pppd.log
> !chat
> *.* /var/log/chat.log
> !ipfw
> *.* /var/log/ipfw.log
The two items I have marked above are what cause the ipfw messages to
go to the console and messages, respectively. You can change those two
(and risk losing some non-ipfw messages that you may want to keep),
you can send the message from those lines through a filter (using a
'|command' action), or you can just live with the way it is.
--
Crist J. Clark cjclark@home.com
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000311124118.C23514>