From owner-freebsd-security Thu Jun 14 10:38:32 2001 Delivered-To: freebsd-security@freebsd.org Received: from nsmail.corp.globalstar.com (gibraltar.globalstar.com [207.88.248.142]) by hub.freebsd.org (Postfix) with ESMTP id B24DA37B406 for ; Thu, 14 Jun 2001 10:38:07 -0700 (PDT) (envelope-from crist.clark@globalstar.com) Received: from globalstar.com ([207.88.153.184]) by nsmail.corp.globalstar.com (Netscape Messaging Server 4.15) with ESMTP id GEXKYU00.U45; Thu, 14 Jun 2001 10:37:42 -0700 Message-ID: <3B28F67D.4A1EB608@globalstar.com> Date: Thu, 14 Jun 2001 10:38:05 -0700 From: "Crist Clark" Organization: Globalstar LP X-Mailer: Mozilla 4.77 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: anindya Cc: freebsd-security@FreeBSD.ORG Subject: Re: remote syslog question References: <20010614131003.B55181-100000@phat.bastard.net> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org anindya wrote: > > > What does the syslog.conf(5) on the log host look like? What does > > it do with the local0 facility? > > I have a default syslog.conf on the loghost, and have simply added > one line: > > local0.* /var/log/ipflog And /var/log/ipflog exists and the syslogd(8) daemon was SIGHUP'ed or restarted since the change? > If you do a tcpdump(8), do you see > > the local0 messages leaving the firewall and getting to the log host? > > Yes, every other type of syslog message goes to the loghost no problems. > Also, if I comment out the local0.* line on the firewall, > I start getting ipf messages, so its all working correctly, > the real question is, is it possible to send local0.* to > both places? Hrm. You are saying that if you comment out the 'local0.*' line in the firewall's syslog.conf(5), then the log host starts logging the ipf(8) stuff correctly? That is to say, it looks like that the local0.* line on the firewall seems to prevent it from forwarding the messages to log host? That would be really strange. No matter what is happening, you may want to run the syslogd(8) processes in debug mode to see what they are actually up to. -- Crist J. Clark Network Security Engineer crist.clark@globalstar.com Globalstar, L.P. (408) 933-4387 FAX: (408) 933-4926 The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact postmaster@globalstar.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message