I can't find any documentation that
makes it clear how to change the way
iptables logs output. What I ideally
want is for NONE of the iptables stuff
to go to any of the above files, but
instead to /var/log/iptables.
By default iptables stuff gets sent to syslog with a facility of kern and a priority of info.
You could choose to switch to a more advanced syslog and then build a filter based on a pattern, or you could just send all the kern.info stuff to /var/log/iptables. You may get things other then iptables in your iptables log.
Assuming you haven't already replaced the syslog that is installed. You might want to make changes like want are shown by the diff below.
--- syslog.conf 2008-08-29 17:40:57.000000000 -0700
+++ syslog.conf.tmp 2009-10-21 10:06:14.000000000 -0700
@@ -8,14 +8,17 @@
#
auth,authpriv.* /var/log/auth.log
-*.*;auth,authpriv.none -/var/log/syslog
+*.*;kern.!info;\
+ auth,authpriv.none -/var/log/syslog
#cron.* /var/log/cron.log
daemon.* -/var/log/daemon.log
-kern.* -/var/log/kern.log
+kern.*;kern.!info -/var/log/kern.log
lpr.* -/var/log/lpr.log
mail.* -/var/log/mail.log
user.* -/var/log/user.log
+kern.info -/var/log/iptables.log
+
#
# Logging for the mail system. Split it up so that
# it is easy to write scripts to parse these files.
@@ -37,6 +40,7 @@
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warning;\
+ kern.!info;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none -/var/log/messages
By editing your iptables rules you can change the priority of the log entries being sent to the syslog and you can add a prefix to filter on with a more advanced syslog.
Or you can use the ULOG target like LapTop006 mentioned and then pass it off to a user space daemon like ulogd, specter, or others.