Date: Fri, 28 Jan 2000 12:59:08 -0800 From: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca> To: Gene Harris <zeus@tetronsoftware.com> Cc: Brett Glass <brett@lariat.org>, The Mad Scientist <madscientist@thegrid.net>, freebsd-security@FreeBSD.ORG Subject: Re: Riddle me this Message-ID: <200001282100.NAA38136@cwsys.cwsent.com> In-Reply-To: Your message of "Thu, 27 Jan 2000 10:19:15 CST." <Pine.BSF.4.10.10001271010530.3225-100000@tetron02.tetronsoftware.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In message <Pine.BSF.4.10.10001271010530.3225-100000@tetron02.tetronsoft
ware.co
m>, Gene Harris writes:
> I prefer a slightly different approach. My syslog.conf file
> contains the two lines:
>
> !ipfw
> *.* /var/log/ipfw
I use swatch3 (swatch3 and 2 Perl module ports are ready but I haven't
submitted the PR's yet to have them included in ports).
I use the following .swatchrc to display some messages in red, others
in blue, and the rest black (or white).
ignore = /ipfw:.* Deny .* blahblah.*/
ignore = /ipfw:.* Deny .* 10\.blahblah.*/
watchfor = /refused connect from/
echo=red,inverse
bell
watchfor = /ALERT:/
echo=red,inverse
bell
watchfor = /Deny TCP blahblah blah blah in via xl0/
echo=blue
watchfor = /Deny TCP blahblah blahblah:113 in via xl0/
echo=blue
watchfor = /Deny TCP blahblah blahblah:80 in via xl0/
echo=blue
watchfor = /ipfw:.* Deny .* in via /
echo=red
bell
watchfor = /ipfw:.* Deny .* out via /
echo
ignore = /.*/
Regards, Phone: (250)387-8437
Cy Schubert Fax: (250)387-5766
Sun/DEC Team, UNIX Group Internet: Cy.Schubert@uumail.gov.bc.ca
ITSD
Province of BC
"COBOL IS A WASTE OF CARDS."
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200001282100.NAA38136>