|I've decided to do some logging of my traffic. Everything is running fine, but I
want to know what packets are being blocked and why. From the IP Filter mailing list archive, I've found
the following steps to enable logging.
- edit /etc/syslog.conf
- add local0.info /var/log/mylog.log
- kill -HUP PID_syslogd
- ipmon -s -n -x
But nothing appears in /var/log/firewall.log. Instead, the messages are
going to /var/log/messages.
/etc/syslog.conf, it prefers tabs, not spaces. Details available here.
Please note that syslog.conf prefers tabs over spaces. If you use spaces, you'll
get a message during reboot which is similar to the following:
unknown priority name "info /var/log/firewall.log"
Here is what I put in my /etc/syslog.conf to get ipmon
messages into the correct file (note that the first line has been split into two lines so
it fits on the page):
You will notice that I added a local0.none to the first line. This
stopped the messages from appearing the the messages log. The next two lines direct
the information to the appropriate files.
Eventually, I'll add something to rotate these logs so they don't get too big.
But that's another topic for a later date.