Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working with some CentOS rules and would like to be able to log the dropped items from iptables out to a separate file. What is the best way to setup CentOS to log dropped iptables matches to a log file under /var/log that is not equal to the messages file.

If it matters, I am using both CentOS 5.5 and newer as well as CentOS 6.x.

share|improve this question
    
I am not sure if this could be done by extending or changing the configuration of rsyslog or not? If so, I would be interested in seeing some examples or how to configure it. –  John Oct 3 '11 at 21:48

1 Answer 1

up vote 4 down vote accepted

There are many ways to redirect iptables output to a separate file.

Iptables supports a a ULOG target, that will send all log messages to a netlink socket instead of the kernel syslog output. There are applications that can read from that ULOG socket and store your logs in databases or files.

For logging with the LOG target you can do things like set a prefix to the log entry, with --log-prefix, and if you are using a more advanced syslog daemon then you can filter based on that pattern, and save the entries into a separate file.

share|improve this answer
    
Thanks for the info. I am using rsyslog-4.6.2-2.el6.x86_64 that comes with CentOS. –  John Oct 4 '11 at 17:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.