syslog question.

[dbizzle]

i'm wanting to dump all of my pix logs to a linux box that i have in the mix. I got that working but i can't seem to figure out how to get it to log to a specific file. all i can seem to get it to log to is my messages file, which makes it rather difficult to find acutal *system* messages. It is a pretty busy firewall so i really need to log to another file. I guess i just dont' understand the whole local0-7 logging facility. any insights would be greatly appriciated.

thanks.

 

[sfrank8734]

I do exactly what you are trying to do. The magic is in the /etc/syslog.conf file (assuming Redhat 8.0):

If your pix is outputting to local4, put the following entry will log firewall stuff to /var/log/firewall.log

local4.* /var/log/firewall.log

Remember to restart syslogd (service syslog restart on Redhat).

Note that you probably have an entry of *.info;mail.none, etc... that logs everything to messages. You'll need to break that out of your config, or your local4.* stuff (as listed above) will still appear in /var/log/messages.

Use
man syslog.conf
to get more details. This should get ya started!

Steve

 

[dbizzle]

that seemed to get it working, but what about messages actually local to the machine. see, i think i'm a little confused about the local0-7. I still want important messages to be logged to messages about the local system ya know?

 

[rheller]

Here's an excerpt from my /etc/syslog.conf file. I managed to log pix stuff to its own file, and avoid swamping /var/log/messages

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
#*.info;mail.none;authpriv.none;cron.none /var/log/messages

# Updated not to put any pix log info in messages!
*.info;mail.none;authpriv.none;cron.none;local4.none /var/log/messages

# Put pix messages in its own file
local4.* /var/log/firewall.log

Also, very, very important: pix logging will fill up /var/log like nobody's business, so you must customize log rotation for it. Create the following file under /etc/logrotate.d called "firewall.log"

/var/log/firewall.log {
compress
rotate 999
daily
missingok
}

The parameters are: compress the log files (using gzip), rotate after 999 weeks, and rotate on a daily basis. I chose daily rotation because if I'm trying to troubleshoot a network event, I can focus on a particular day. Keep in mind that this is controlled by /etc/cron.daily/logrotate, which usually runs at 4:02am, not midnight. Hope this helps!

 

[dbizzle]

cool, thanks. I actually did setup a log rotation. Its not through logrotate.d but a script that i have done myself. I like to move them to a differnent directory and place extensions on them like *.tue *.wed etc.. I think i understand exactly how the syslog works now after reading the man page about 10 times thanks again man.