On 08/01/2011 03:23 PM, Kenneth Porter wrote:
--On Wednesday, July 20, 2011 10:44 AM -0500 cbulist@gmail.com wrote:
We are trying to track some specific rules using LOG as target. Everything is working well but the problem is that iptables is flooding the console with LOG messages.
In addition to the other suggestions, you could switch to rsyslog, included in CentOS base. It provides much more flexible filtering options. Add a unique string to your iptables log lines and match on it to divert all of its logs to a separate file (or virtual console).
After switching to rsyslog, my /var/log/messages rarely gets a new message, as I've diverted everything to subsystem-specific log files. (Remember to add logrotate entries for them so your disk doesn't fill up.)
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Here is an example using rsyslog: note log-level7 is kern.debug
iptables log line: -A ACCEPTnLOG -m limit --limit 30/min -j LOG --log-level 7 --log-prefix "fw (ACCEPTnLOG) "
part of rsyslog.conf - first don't log kern.debug messages to /var/log/messages ... *.info;kern.!=debug;mail.none;authpriv.none;cron.none /var/log/messages ... #put messages that start with "fw " in /var/log/firewall.log :msg, startswith, "fw " -/var/log/firewall.log