diff --git a/docs/shorewall_logging.xml b/docs/shorewall_logging.xml index 4940e295e..c9936bdb5 100644 --- a/docs/shorewall_logging.xml +++ b/docs/shorewall_logging.xml @@ -239,9 +239,9 @@ - If your kernel has ULOG target support (and most vendor-supplied - kernels do), you may also specify a log level of ULOG (must be all - caps). When ULOG is used, Shorewall will direct Netfilter to log the + If your kernel has NFLOG target support (and most vendor-supplied + kernels do), you may also specify a log level of NFLOG (must be all + caps). When NFLOG is used, Shorewall will direct Netfilter to log the related messages via the ULOG target which will send them to a process called ulogd. The ulogd program is included in most distributions and is also available from - The ULOG logging mechanism is The NFLOG logging mechanism is completely separate from syslog. Once you switch to ULOG, the settings in /etc/syslog.conf have absolutely no effect on your Shorewall logging (except for @@ -259,11 +259,11 @@ You will need to change all instances of log levels (usually info) in your Shorewall configuration files to - ULOG - this includes entries in the policy, rules and + NFLOG - this includes entries in the policy, rules and shorewall.conf files. Here's what I had at one time: gateway:/etc/shorewall# grep -v ^\# * | egrep '\$LOG|ULOG|LOGFILE' -params:LOG=ULOG +params:LOG=NFOG policy:loc $FW REJECT $LOG policy:net all DROP $LOG 10/sec:40 policy:all all REJECT $LOG @@ -287,9 +287,8 @@ gateway:/etc/shorewall# logwatch and dump commands. - The NFLOG target, a successor to ULOG, is supported shorewall. - Both ULOG and NFLOG may be followed by a list of up to three numbers in - parentheses. + The NFLOG target is a successor to ULOG. Both ULOG and NFLOG may + be followed by a list of up to three numbers in parentheses. @@ -342,6 +341,11 @@ stack=log:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,firewall: [firewall] file="/var/log/firewall" sync=1 + + + This sample config file assumes that NFLOG is being used in + logging rules and policies. + @@ -470,7 +474,7 @@ sync=1 shorewall.conf(5) and shorewall6.conf(5) have a - number of options whose values are log levels. Beginnint with Shorewall + number of options whose values are log levels. Beginning with Shorewall 5.0.0, these specifcations may include a log tag as described above.