Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am using ubuntu 10.10. with iptables! I want to log my firewall drops in the file /var/log/firewall and NOT in any other logfile.

So I added the following line to my file: /etc/rsyslog.d/50-default.conf:

#iptables Log
kern.warning    /var/log/firewall.log

This way my drops and logs from iptables are logging into the right file!

Now i dont know what to add to not log the drops in the other files.. At this time it write every drop in /var/log/messages /var/log/kern.log and /var/log/syslog

Heeeelp :)

I found this one : http://serverfault.com/questions/45402/add-a-local-application-to-syslog-excluded-from-var-log-messages but it doesnt work.. Maybe because its Rsyslogd in Ubuntu 10.10?

Thanks!

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Use a discard action after the iptables log, but before the other logs.

kern.warning   /var/log/firewall.log
kern.warning   ~
*.*            /var/log/messages
share|improve this answer
    
Thank you very much! –  Fake4d Oct 14 '10 at 6:08
    
What does ~ mean? (the rsyslog manual is a little vague). –  Stefan Lasiewski Oct 20 '10 at 0:09
1  
@Stefan: rsyslog.conf(5) man page, ACTIONS section, Discard subsection. –  Ignacio Vazquez-Abrams Oct 20 '10 at 0:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.