diff --git a/docs/standalone.xml b/docs/standalone.xml
index 0331b55b1..f4f408a40 100644
--- a/docs/standalone.xml
+++ b/docs/standalone.xml
@@ -434,6 +434,58 @@ root@lists:~#
+
+ Logging
+
+ Shorewall does not maintain a log itself but rather relies on your
+ system's logging
+ configuration. The following commands rely on knowing where
+ Netfilter messages are logged:
+
+
+
+ shorewall show log (Displays the last 20
+ netfilter log messages)
+
+
+
+ shorewall logwatch (Polls the log at a
+ settable interval
+
+
+
+ shorewall dump (Produces an extensive report
+ for inclusion in Shorewall problem reports)
+
+
+
+ It is important that these commands work properly because when you
+ encounter connection problems when Shorewall is running, the first thing
+ that you should do is to look at the Netfilter log; with the help of
+ Shorewall FAQ 17, you can usually
+ resolve the problem quickly.
+
+ Most commonly, Netfilter messages are logged to
+ /var/log/messages. Recent
+ SuSE/OpenSuSE releases come preconfigured with
+ syslog-ng and log netfilter messages to
+ /var/log/firewall.
+
+
+
+ If you are running a distribution that logs netfilter messages to a
+ log other than /var/log/messages, then modify the
+ LOGFILE setting in /etc/shorewall/shorewall.conf to
+ specify the name of your log.
+
+
+ The LOGFILE setting does not control where the Netfilter log is
+ maintained -- it simply tells the /sbin/shorewall
+ utility where to find the log.
+
+
+
Enabling other Connections
diff --git a/docs/three-interface.xml b/docs/three-interface.xml
index b1e225611..124730ffa 100644
--- a/docs/three-interface.xml
+++ b/docs/three-interface.xml
@@ -956,6 +956,57 @@ ACCEPT net $FW tcp 80
+
+ Logging
+
+ Shorewall does not maintain a log itself but rather relies on your
+ system's logging configuration.
+ The following commands rely
+ on knowing where Netfilter messages are logged:
+
+
+
+ shorewall show log (Displays the last 20
+ netfilter log messages)
+
+
+
+ shorewall logwatch (Polls the log at a
+ settable interval
+
+
+
+ shorewall dump (Produces an extensive report
+ for inclusion in Shorewall problem reports)
+
+
+
+ It is important that these commands work properly because when you
+ encounter connection problems when Shorewall is running, the first thing
+ that you should do is to look at the Netfilter log; with the help of
+ Shorewall FAQ 17, you can usually
+ resolve the problem quickly.
+
+ Most commonly, Netfilter messages are logged to
+ /var/log/messages. Recent
+ SuSE/OpenSuSE releases come preconfigured with
+ syslog-ng and log netfilter messages to
+ /var/log/firewall.
+
+
+
+ If you are running a distribution that logs netfilter messages to a
+ log other than /var/log/messages, then modify the
+ LOGFILE setting in /etc/shorewall/shorewall.conf to
+ specify the name of your log.
+
+
+ The LOGFILE setting does not control where the Netfilter log is
+ maintained -- it simply tells the /sbin/shorewall
+ utility where to find the log.
+
+
+
Some Things to Keep in Mind
diff --git a/docs/two-interface.xml b/docs/two-interface.xml
index 53dd143a8..39874c7a3 100644
--- a/docs/two-interface.xml
+++ b/docs/two-interface.xml
@@ -875,6 +875,57 @@ ACCEPT loc $FW tcp 80 #Allow Weblet to work
+
+ Logging
+
+ Shorewall does not maintain a log itself but rather relies on your
+ system's logging configuration.
+ The following commands rely
+ on knowing where Netfilter messages are logged:
+
+
+
+ shorewall show log (Displays the last 20
+ netfilter log messages)
+
+
+
+ shorewall logwatch (Polls the log at a
+ settable interval
+
+
+
+ shorewall dump (Produces an extensive report
+ for inclusion in Shorewall problem reports)
+
+
+
+ It is important that these commands work properly because when you
+ encounter connection problems when Shorewall is running, the first thing
+ that you should do is to look at the Netfilter log; with the help of
+ Shorewall FAQ 17, you can usually
+ resolve the problem quickly.
+
+ Most commonly, Netfilter messages are logged to
+ /var/log/messages. Recent
+ SuSE/OpenSuSE releases come preconfigured with
+ syslog-ng and log netfilter messages to
+ /var/log/firewall.
+
+
+
+ If you are running a distribution that logs netfilter messages to a
+ log other than /var/log/messages, then modify the
+ LOGFILE setting in /etc/shorewall/shorewall.conf to
+ specify the name of your log.
+
+
+ The LOGFILE setting does not control where the Netfilter log is
+ maintained -- it simply tells the /sbin/shorewall
+ utility where to find the log.
+
+
+
Some Things to Keep in Mind