How can I configure
/etc/syslog.conf file in order to save log information about
iptables in a specific file.
I want to save these information separately, so I can extract what I want easily and rapidly.
Take a look in the man page for
NOTE: This method of logging is called fixed priorities. They are either numbers or names (1,2,3,4,..) or (DEBUG, WARN, INFO, etc.).
If by chance you're using
Then add thils switch to your iptables rules that you want to log:
As an alternative you could also log the messages using this type of property filter:
NOTE: This 2nd method doesn't require any changes to
This assumes your firewall already makes logs, as any sane firewall should. For some examples, it requires an identifiable message, such as "NETFILTER" in slm's example.
make a file in rsyslog.d
This works in CentOS 7. I don't know how to verify that it came from the firewall other than looking for IN and OUT... CentOS is weird. Don't use this unless the next version doesn't work.
This works in CentOS 7 and checks for the message content too (replace "Shorewall" with whatever you have in your -j LOG rule's message):
This works in others (Ubuntu, Debian, openSUSE). And this is the best way to do it. No searching for strings in the message:
And here is what a default openSUSE machine has (which I think every distro should have and is missing) (difference seems to be only "stop" instead of "& ~"; not all systems support both syntaxes):
And for all of the above, don't forget a logrotate.d file too: