Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for example ::IPT::LOG::.

How can I configure rsyslog to redirect messages tagged that way into a separate log file? Man page for rsyslog looks too cryptic to me.

share|improve this question
    
For answers to the same problem for syslog and syslog-ng, see this thread about the same problem. –  Caleb Jul 4 '11 at 22:20

2 Answers 2

up vote 7 down vote accepted

In addition on selector-based filtering, rsyslogd can filter on patterns found in log message properties. To accomplish what you are trying to do, you can create a property-based filter to match the string you are using in your iptables rules. If you were to use --log-prefix "unique_prefix: " in your iptables rule, you would need to add this to rsyslog.conf:

:msg,startswith,"unique_prefix" /var/log/iptables

This rule will test log messages for your prefix and send them to /var/log/iptables (in addition to wherever else rsyslog is configured to send them). If you need to have the messages appear in /var/log/iptables but not elsewhere, place the new rule above others, and follow it with a line containing & ~. Complete example:

:msg,startswith,"unique_prefix" /var/log/iptables
& ~
#
# The rest of my rules appear below
# ...
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

Rsyslog rules can have multiple actions. Subsequent actions are defined on new lines beginning with an ampersand (&). In the example above, the first rule has two actions: send output to /var/log/iptables, and then discard message (~). See rsyslog docs on actions and filters for more information on the rules in this answer

Edited to use startswith rather than contains for performance considerations. Since the iptables --log-prefix is indeed a prefix, and thus will be at the start of the message.

share|improve this answer
    
So in this case output will go to the both log files? How can I also indeed redirect the messages, so they don't appear in syslog, but in iptables' log only? –  mbaitoff Jul 5 '11 at 1:31
    
Added more complete example and information about rule actions –  Eli Heady Jul 5 '11 at 12:01

My experience, given the nature of how the rsyslog.conf file is parsed, the additional configuration lines in /etc/rsyslog.conf must be before all other configuration lines. If added to the end of the file, the ip-tables logging will still be appended to /var/log/messages and also re-directed to the /var/log/iptables.log file.

share|improve this answer
    
Well that was useful! I was wondering why I still have 'iptables' rubbish in system log in addition to dedicated log. –  mbaitoff Dec 19 '11 at 5:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.