Date: Thu, 14 Jun 2001 10:38:05 -0700 From: "Crist Clark" <crist.clark@globalstar.com> To: anindya <anindya@goonda.org> Cc: freebsd-security@FreeBSD.ORG Subject: Re: remote syslog question Message-ID: <3B28F67D.4A1EB608@globalstar.com> References: <20010614131003.B55181-100000@phat.bastard.net>
next in thread | previous in thread | raw e-mail | index | archive | help
anindya wrote: > > > What does the syslog.conf(5) on the log host look like? What does > > it do with the local0 facility? > > I have a default syslog.conf on the loghost, and have simply added > one line: > > local0.* /var/log/ipflog And /var/log/ipflog exists and the syslogd(8) daemon was SIGHUP'ed or restarted since the change? > If you do a tcpdump(8), do you see > > the local0 messages leaving the firewall and getting to the log host? > > Yes, every other type of syslog message goes to the loghost no problems. > Also, if I comment out the local0.* line on the firewall, > I start getting ipf messages, so its all working correctly, > the real question is, is it possible to send local0.* to > both places? Hrm. You are saying that if you comment out the 'local0.*' line in the firewall's syslog.conf(5), then the log host starts logging the ipf(8) stuff correctly? That is to say, it looks like that the local0.* line on the firewall seems to prevent it from forwarding the messages to log host? That would be really strange. No matter what is happening, you may want to run the syslogd(8) processes in debug mode to see what they are actually up to. -- Crist J. Clark Network Security Engineer crist.clark@globalstar.com Globalstar, L.P. (408) 933-4387 FAX: (408) 933-4926 The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact postmaster@globalstar.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3B28F67D.4A1EB608>