<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 08/01/2011 03:23 PM, Kenneth Porter wrote:
<blockquote cite="mid:1DC310DCBA97BA3F87A94564@%5B10.170.7.6%5D"
type="cite">
<pre wrap="">--On Wednesday, July 20, 2011 10:44 AM -0500 <a class="moz-txt-link-abbreviated" href="mailto:cbulist@gmail.com">cbulist@gmail.com</a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">We are trying to track some specific rules using LOG as target.
Everything is working well but the problem is that iptables is flooding
the console with LOG messages.
</pre>
</blockquote>
<pre wrap="">
In addition to the other suggestions, you could switch to rsyslog, included
in CentOS base. It provides much more flexible filtering options. Add a
unique string to your iptables log lines and match on it to divert all of
its logs to a separate file (or virtual console).
After switching to rsyslog, my /var/log/messages rarely gets a new message,
as I've diverted everything to subsystem-specific log files. (Remember to
add logrotate entries for them so your disk doesn't fill up.)
_______________________________________________
CentOS mailing list
<a class="moz-txt-link-abbreviated" href="mailto:CentOS@centos.org">CentOS@centos.org</a>
<a class="moz-txt-link-freetext" href="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</a>
</pre>
</blockquote>
<font face="sans-serif">Here is an example using rsyslog:<br>
note log-level7 is kern.debug<br>
<br>
iptables log line:<br>
-A ACCEPTnLOG -m limit --limit 30/min -j LOG --log-level 7
--log-prefix "fw (ACCEPTnLOG) "<br>
<br>
part of rsyslog.conf - first don't log kern.debug messages to
/var/log/messages<br>
...<br>
*.info;kern.!=debug;mail.none;authpriv.none;cron.none
/var/log/messages<br>
...<br>
#put messages that start with "fw " in /var/log/firewall.log<br>
:msg, startswith, "fw " -/var/log/firewall.log<br>
<br>
<br>
</font><br>
<div class="moz-signature">-- <br>
Stephen Clark<br>
<b>NetWolves</b><br>
Sr. Software Engineer III<br>
Phone: 813-579-3200<br>
Fax: 813-882-0209<br>
Email: <a class="moz-txt-link-abbreviated" href="mailto:steve.clark@netwolves.com">steve.clark@netwolves.com</a><br>
<a class="moz-txt-link-freetext" href="http://www.netwolves.com">http://www.netwolves.com</a><br>
</div>
</body>
</html>