From owner-freebsd-questions@FreeBSD.ORG Sat May 14 12:28:20 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 37A8F16A4CE for ; Sat, 14 May 2005 12:28:20 +0000 (GMT) Received: from pne-smtpout2-sn1.fre.skanova.net (pne-smtpout2-sn1.fre.skanova.net [81.228.11.159]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8F46C43D69 for ; Sat, 14 May 2005 12:28:19 +0000 (GMT) (envelope-from freebsd@stortsett.se) Received: from kalle.stortsett.local (81.230.166.174) by pne-smtpout2-sn1.fre.skanova.net (7.1.026.7) id 42687F20005F10ED for freebsd-questions@freebsd.org; Sat, 14 May 2005 14:28:18 +0200 Received: from kalle.stortsett.local (localhost [127.0.0.1]) by kalle.stortsett.local (Postfix) with ESMTP id 5CF5C6198 for ; Sat, 14 May 2005 14:28:18 +0200 (CEST) Received: from [192.168.214.63] (unknown [192.168.214.63]) by kalle.stortsett.local (Postfix) with ESMTP id E78586173 for ; Sat, 14 May 2005 14:28:17 +0200 (CEST) Message-ID: <4285EEDF.4070902@stortsett.se> Date: Sat, 14 May 2005 14:28:15 +0200 From: Per Berger User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: FreeBSD questions Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV using ClamSMTP Subject: ipfilter and logging... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 May 2005 12:28:20 -0000 Hi! So I've installed ipfilter and ipnat with help from the handbook. It works great so now my box is connected to my ADSL connection. But... (there is always a but...) I am confused regarding logging. The handbook says that I can add "security.*" in syslog.conf and specify a logfile to log the firewall. But there is already an entry in syslog.conf "security.*" from install ( I am running 5.4-RELEASE upgraded from 5.3 via cvsup (which worked great btw...)) pointing at /var/log/security. And all logging goes to /var/log/security. But at least some of it goes also to /var/log/messages; seems to be the "final" rules that goes there, i.e. such as "block in log first quick on fxp0 all". My syslog.conf looks like this: " ... *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages security.* /var/log/security ... " (sorry for truncation, hope you get the picture...) Now for my question. I do really want a separate log file for ipfilter. How would a change syslog.conf to separate out the ipfilter logs from the rest without breaking any other logging? Or, at least, how do I change the line for /var/log/messages so that no ipfilter stuff goes there without breaking something else? Sorry if this is obvious stuff but I've searched for the answer but is only getting more confused the more I search... -- Per Berger _ ASCII ribbon campaign ( ) - against HTML, vCards and X - proprietary attachments in e-mail / \