holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Update to logging article

Browse Source 
- correct a typo
- recommend using NFLOG rather than ULOG
This commit is contained in:
Tom Eastep 2016-10-12 10:02:59 -07:00
parent b80d4c2320
commit 289825a76f
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
1 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
docs/shorewall_logging.xml
View File

@ -239,9 +239,9 @@
</listitem> </listitem>
</orderedlist> </orderedlist>
<para>If your kernel has ULOG target support (and most vendor-supplied <para>If your kernel has NFLOG target support (and most vendor-supplied
kernels do), you may also specify a log level of ULOG (must be all kernels do), you may also specify a log level of NFLOG (must be all
caps). When ULOG is used, Shorewall will direct Netfilter to log the caps). When NFLOG is used, Shorewall will direct Netfilter to log the
related messages via the ULOG target which will send them to a process related messages via the ULOG target which will send them to a process
called <quote>ulogd</quote>. The ulogd program is included in most called <quote>ulogd</quote>. The ulogd program is included in most
distributions and is also available from <ulink distributions and is also available from <ulink
@ -250,7 +250,7 @@
file.</para> file.</para>
<note> <note>
<para>The ULOG logging mechanism is <emphasis <para>The NFLOG logging mechanism is <emphasis
role="underline">completely separate</emphasis> from syslog. Once you role="underline">completely separate</emphasis> from syslog. Once you
switch to ULOG, the settings in <filename>/etc/syslog.conf</filename> switch to ULOG, the settings in <filename>/etc/syslog.conf</filename>
have absolutely no effect on your Shorewall logging (except for have absolutely no effect on your Shorewall logging (except for
@ -259,11 +259,11 @@
<para>You will need to change all instances of log levels (usually <para>You will need to change all instances of log levels (usually
<quote>info</quote>) in your Shorewall configuration files to <quote>info</quote>) in your Shorewall configuration files to
<quote>ULOG</quote> - this includes entries in the policy, rules and <quote>NFLOG</quote> - this includes entries in the policy, rules and
shorewall.conf files. Here's what I had at one time:</para> shorewall.conf files. Here's what I had at one time:</para>
<programlisting>gateway:/etc/shorewall# grep -v ^\# * | egrep '\$LOG|ULOG|LOGFILE' <programlisting>gateway:/etc/shorewall# grep -v ^\# * | egrep '\$LOG|ULOG|LOGFILE'
params:LOG=ULOG params:LOG=NFOG
policy:loc $FW REJECT $LOG policy:loc $FW REJECT $LOG
policy:net all DROP $LOG 10/sec:40 policy:net all DROP $LOG 10/sec:40
policy:all all REJECT $LOG policy:all all REJECT $LOG
@ -287,9 +287,8 @@ gateway:/etc/shorewall# </programl
<quote><command>logwatch</command></quote> and <quote><command>logwatch</command></quote> and
<quote><command>dump</command></quote> commands.</para> <quote><command>dump</command></quote> commands.</para>
<para>The NFLOG target, a successor to ULOG, is supported shorewall. <para>The NFLOG target is a successor to ULOG. Both ULOG and NFLOG may
Both ULOG and NFLOG may be followed by a list of up to three numbers in be followed by a list of up to three numbers in parentheses.</para>
parentheses.</para>
<itemizedlist> <itemizedlist>
<listitem> <listitem>
@ -342,6 +341,11 @@ stack=log:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,firewall:
[firewall] [firewall]
file="/var/log/firewall" file="/var/log/firewall"
sync=1</programlisting> sync=1</programlisting>
<note>
<para>This sample config file assumes that NFLOG is being used in
logging rules and policies.</para>
</note>
</section> </section>
</section> </section>
@ -470,7 +474,7 @@ sync=1</programlisting>
<para><ulink <para><ulink
url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink> and <ulink url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink> and <ulink
url="manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink> have a url="manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink> have a
number of options whose values are log levels. Beginnint with Shorewall number of options whose values are log levels. Beginning with Shorewall
5.0.0, these specifcations may include a log tag as described <link 5.0.0, these specifcations may include a log tag as described <link
linkend="LogTags">above</link>.</para> linkend="LogTags">above</link>.</para>
</section> </section>