Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm running OpenSUSE 11.4. The problem is that I can set easily what to log, but not where to log. And currently the same logs are written to /var/log/firewall and /var/log/messages. I still want messages be written into the first one, but not the second one — it is redundant and it is polluting regular system logs.

So how to stop the firewall from writting logs to /var/log/messages?

I have /etc/rsyslog.conf, and its contents are:

##
## Note, that when the MYSQL, PGSQL, GSSAPI, GnuTLS or SNMP modules
## (provided in separate rsyslog-module-* packages) are enabled, the
## configuration can't be used on a system with /usr on a remote
## filesystem.
## [The modules are linked against libraries installed bellow of /usr
##  thus also installed in /usr/lib*/rsyslog because of this.]
##
## You can change it by adding network-remotefs to the Required-Start
## and Required-Stop LSB init tags in the /etc/init.d/syslog script.
##

#
# if you experience problems, check
# http://www.rsyslog.com/troubleshoot for assistance
# and report them at http://bugzilla.novell.com/
#

# rsyslog v3: load input modules
# If you do not load inputs, nothing happens!

$ModLoad immark.so     # provides --MARK-- message capability (every 1 hour)
$MarkMessagePeriod     3600

$ModLoad imuxsock.so   # provides support for local system logging (e.g. via logger command)
                       # reduce dupplicate log messages (last message repeated n times)
$RepeatedMsgReduction on

$ModLoad imklog.so     # kernel logging (may be also provided by /sbin/klogd),
                       # see also http://www.rsyslog.com/doc-imklog.html.
$klogConsoleLogLevel 1 # set log level 1 (same as in /etc/sysconfig/syslog).

#
# Use traditional log format by default. To change it for a single
# file, append ";RSYSLOG_TraditionalFileFormat" to the filename.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Include config generated by /etc/init.d/syslog script
# using the SYSLOGD_ADDITIONAL_SOCKET* variables in the
# /etc/sysconfig/syslog file.
#
$IncludeConfig /var/run/rsyslog/additional-log-sockets.conf

#
# Include config files, that the admin provided? :
#
$IncludeConfig /etc/rsyslog.d/*.conf

###
# print most important on tty10 and on the xconsole pipe
#
if      ( \
            /* kernel up to warning except of firewall  */ \
            ($syslogfacility-text == 'kern')      and      \
            ($syslogseverity <= 4 /* warning */ ) and not  \
            ($msg contains 'IN=' and $msg contains 'OUT=') \
        ) or ( \
            /* up to errors except of facility authpriv */ \
            ($syslogseverity <= 3 /* errors  */ ) and not  \
            ($syslogfacility-text == 'authpriv')           \
        ) \
then    /dev/tty10
&       |/dev/xconsole

# Emergency messages to everyone logged on (wall)
*.emerg                                  *

# enable this, if you want that root is informed
# immediately, e.g. of logins
#*.alert                                root

#
# firewall messages into separate file and stop their further processing
#
if      ($syslogfacility-text == 'kern') and \
        ($msg contains 'IN=' and $msg contains 'OUT=') \
then    -/var/log/firewall
&       ~

#
# acpid messages into separate file and stop their further processing
#
# => all acpid messages for debuging (uncomment if needed):
#if     ($programname == 'acpid' or $syslogtag == '[acpid]:') then \
#       -/var/log/acpid
#
# => up to notice (skip info and debug)
if      ($programname == 'acpid' or $syslogtag == '[acpid]:') and \
        ($syslogseverity <= 5 /* notice */) \
then    -/var/log/acpid
&       ~

#
# NetworkManager into separate file and stop their further processing
#
if      ($programname == 'NetworkManager') or \
        ($programname startswith 'nm-') \
then    -/var/log/NetworkManager
&       ~

#
# email-messages
#
mail.*                                  -/var/log/mail
mail.info                               -/var/log/mail.info
mail.warning                            -/var/log/mail.warn
mail.err                                 /var/log/mail.err

#
# news-messages
#
news.crit                               -/var/log/news/news.crit
news.err                                -/var/log/news/news.err
news.notice                             -/var/log/news/news.notice
# enable this, if you want to keep all news messages
# in one file
#news.*                                 -/var/log/news.all

#
# Warnings in one file
#
*.=warning;*.=err                       -/var/log/warn
*.crit                                   /var/log/warn

#
# the rest in one file
#
*.*;mail.none;news.none                 -/var/log/messages

#
# enable this, if you want to keep all messages
# in one file
#*.*                                    -/var/log/allmessages

#
# Some foreign boot scripts require local7
#
local0,local1.*                         -/var/log/localmessages
local2,local3.*                         -/var/log/localmessages
local4,local5.*                         -/var/log/localmessages
local6,local7.*                         -/var/log/localmessages

###
share|improve this question
    
What is the contents of /etc/syslog.conf or /etc/rsyslog.conf (whichever you have)? –  Gilles Jul 16 '11 at 12:26
    
Naive question: denying write access won't work? –  Philomath Jul 17 '11 at 17:59
    
@Gilles, posted. –  greenoldman Jul 18 '11 at 18:27
    
@Philomath, probably it works, but I would log something. Firewall is just one of the services, and I won't to stop it from logging, not disabling logging at all. –  greenoldman Jul 18 '11 at 18:28
    
Hmm, I don't get it. The … then -/var/log/firewall & ~ part should mean “log firewall stuff to /var/log/firewall and nowhere else”. –  Gilles Jul 18 '11 at 19:23

1 Answer 1

up vote 2 down vote accepted

Gilles, no wonder you were puzzled (I wasn't, I just didn't understand the syntax ;-) ), it was a bug:

https://bugzilla.novell.com/show_bug.cgi?id=676041

Luckily fixed already.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.