From owner-freebsd-questions@FreeBSD.ORG Tue Sep 21 07:09:09 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4778416A4D3 for ; Tue, 21 Sep 2004 07:09:09 +0000 (GMT) Received: from smtp.infracaninophile.co.uk (smtp.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id EAA5343D48 for ; Tue, 21 Sep 2004 07:09:07 +0000 (GMT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost.infracaninophile.co.uk [IPv6:::1])i8L792PA076599 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 21 Sep 2004 08:09:02 +0100 (BST) (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost)i8L792Jx076598; Tue, 21 Sep 2004 08:09:02 +0100 (BST) (envelope-from matthew) Date: Tue, 21 Sep 2004 08:09:02 +0100 From: Matthew Seaman To: Eric F Crist Message-ID: <20040921070902.GA76127@happy-idiot-talk.infracaninophile.co.uk> Mail-Followup-To: Matthew Seaman , Eric F Crist , freebsd-questions@freebsd.org References: <20040920222503.E23065@grog.secure-computing.net> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="qMm9M+Fa2AknHoGS" Content-Disposition: inline In-Reply-To: <20040920222503.E23065@grog.secure-computing.net> User-Agent: Mutt/1.4.2.1i X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-1.5.6 (smtp.infracaninophile.co.uk [IPv6:::1]); Tue, 21 Sep 2004 08:09:02 +0100 (BST) X-Virus-Scanned: clamd / ClamAV version devel-20040904, clamav-milter version 0.75l on smtp.infracaninophile.co.uk X-Virus-Status: Clean X-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=2.64 X-Spam-Checker-Version: SpamAssassin 2.64 (2004-01-11) on happy-idiot-talk.infracaninophile.co.uk cc: freebsd-questions@freebsd.org Subject: Re: IPFW logging... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Sep 2004 07:09:09 -0000 --qMm9M+Fa2AknHoGS Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Sep 20, 2004 at 10:27:22PM -0500, Eric F Crist wrote: > IPFW used to log all entries with the 'log' included in the rule, but=20 > randomely, to me, anyways, stopped doing so. I can't seem to get it to= =20 > continue logging. >=20 > Does anyone have any insight? I'm running FreeBSD 4.10 from about 2=20 > months ago. I'm going to cvsup tonight to see if it helps. what log=20 > files can I check to verify things are working? Thanks. Are you just running into the verbose limit on log messages? That's the setting of the net.inet.ip.fw.verbose_limit sysctl. That exists to prevent anyone DOS-ing you by sending so many nasty packets that the log files fill up your disk. I find setting this to a fairly high number (1024) and doing a daily reset of the counters keeps the logging data coming through more or less smoothly. I put this in /etc/daily.local: #!/bin/sh =20 PATH=3D/usr/bin:/bin:/sbin ; export PATH =20 ipfw resetlog =20 # # That's All Folks! # Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --qMm9M+Fa2AknHoGS Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (FreeBSD) iD8DBQFBT9OOiD657aJF7eIRAnagAKCrdNFojuQ9i976tee1ulGnRJ/xHgCeIaQe BdfxBUd04SzY1Fo4o5C8cv8= =BtTA -----END PGP SIGNATURE----- --qMm9M+Fa2AknHoGS--