From owner-freebsd-security Thu Jun 14 9:56:18 2001 Delivered-To: freebsd-security@freebsd.org Received: from nsmail.corp.globalstar.com (gibraltar.globalstar.com [207.88.248.142]) by hub.freebsd.org (Postfix) with ESMTP id E642B37B403 for ; Thu, 14 Jun 2001 09:56:07 -0700 (PDT) (envelope-from crist.clark@globalstar.com) Received: from globalstar.com ([207.88.153.184]) by nsmail.corp.globalstar.com (Netscape Messaging Server 4.15) with ESMTP id GEXJ0U00.45Q; Thu, 14 Jun 2001 09:55:42 -0700 Message-ID: <3B28ECA6.C29995BF@globalstar.com> Date: Thu, 14 Jun 2001 09:56:06 -0700 From: "Crist Clark" Organization: Globalstar LP X-Mailer: Mozilla 4.77 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: anindya Cc: freebsd-security@FreeBSD.ORG Subject: Re: remote syslog question References: <20010614123656.K55091-100000@phat.bastard.net> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org anindya wrote: > > Hi folks, > > I've been running a very nice 4.3-STABLE system with > IPF as my firewall for some time now, without problems. Of > course I am sending my syslogs to a remote host, but > I want to keep an additional copy of the ipf logs locally. > My syslog.conf has just 2 lines: > > *.* @loghost > local0.* /var/log/ipflog > > I was guessing that the local0.* stuff would be sent to > both places, but that is not the case; I don't get > ipf logs on my loghost. [snip] What does the syslog.conf(5) on the log host look like? What does it do with the local0 facility? If you do a tcpdump(8), do you see the local0 messages leaving the firewall and getting to the log host? -- Crist J. Clark Network Security Engineer crist.clark@globalstar.com Globalstar, L.P. (408) 933-4387 FAX: (408) 933-4926 The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact postmaster@globalstar.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message