From owner-freebsd-questions  Sat Mar 11  9:36:22 2000
Delivered-To: freebsd-questions@freebsd.org
Received: from cc942873-a.ewndsr1.nj.home.com (cc942873-a.ewndsr1.nj.home.com [24.2.89.207])
	by hub.freebsd.org (Postfix) with ESMTP id 0DE6037BC99
	for <freebsd-questions@FreeBSD.ORG>; Sat, 11 Mar 2000 09:36:17 -0800 (PST)
	(envelope-from cjc@cc942873-a.ewndsr1.nj.home.com)
Received: (from cjc@localhost)
	by cc942873-a.ewndsr1.nj.home.com (8.9.3/8.9.3) id MAA23655;
	Sat, 11 Mar 2000 12:41:19 -0500 (EST)
	(envelope-from cjc)
Date: Sat, 11 Mar 2000 12:41:19 -0500
From: "Crist J. Clark" <cjc@cc942873-a.ewndsr1.nj.home.com>
To: Terry Todd <tlt@tltodd.com>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: ipfw logging
Message-ID: <20000311124118.C23514@cc942873-a.ewndsr1.nj.home.com>
Reply-To: cjclark@home.com
References: <200003111405.IAA00763@tltodd.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 1.0i
In-Reply-To: <200003111405.IAA00763@tltodd.com>; from tlt@tltodd.com on Sat, Mar 11, 2000 at 08:05:58AM -0600
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On Sat, Mar 11, 2000 at 08:05:58AM -0600, Terry Todd wrote:
> 
> If I turn on IPFIREWALL_VERBOSE I get ipfw logging to log to the
> console and /var/log/messages and /var/log/ipfw.log.  If I turn
> off IPFIREWALL_VERBOSE I get no logging at all.  How can I set it
> up to log only to /var/log/ipfw.log?
> 
> TIA,
> Terry Todd
> 
> My syslog.conf file is as follows:
> #	$Id: syslog.conf,v 1.9 1998/10/14 21:59:55 nate Exp $
> #
> #	Spaces are NOT valid field separators in this file.
> #	Consult the syslog.conf(5) manpage.
> *.err;kern.debug;auth.notice;mail.crit		/dev/console
        ^^^^^^^^^^
> *.notice;kern.debug;lpr.info;mail.crit;news.err	/var/log/messages
           ^^^^^^^^^^
> mail.info					/var/log/maillog
> lpr.info					/var/log/lpd-errs
> ftp.*						/var/log/ftp.log
> cron.*						/var/cron/log
> *.err						root
> *.notice;news.err				root
> *.alert						root
> *.emerg						*
> # uncomment these if you're running inn
> # news.crit					/var/log/news/news.crit
> # news.err					/var/log/news/news.err
> # news.notice					/var/log/news/news.notice
> !startslip
> *.*						/var/log/slip.log
> !ppp
> *.*						/var/log/ppp.log
> !pppd
> *.*						/var/log/pppd.log
> !chat
> *.*						/var/log/chat.log
> !ipfw
> *.*						/var/log/ipfw.log

The two items I have marked above are what cause the ipfw messages to
go to the console and messages, respectively. You can change those two
(and risk losing some non-ipfw messages that you may want to keep),
you can send the message from those lines through a filter (using a
'|command' action), or you can just live with the way it is.
-- 
Crist J. Clark                           cjclark@home.com


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message