logging to a different place than kernel ring buffer
Hello!
I want to log denied traffic, but to syslog or a file rather than the kernel ring buffer because that messes up the virtual consoles.
What is a good way to achieve that?
Signature · 4 lines
Gruß Marco Send unsolicited bulk mail to [email protected]
Quoted 4 lines · Marco Moock
I want to log denied traffic, but to syslog or a file rather than the kernel ring buffer because that messes up the virtual consoles.
What is a good way to achieve that?
Ulogd2
https://www.netfilter.org/projects/ulogd/
c'ya
sven-haegar
Signature · 2 lines
Three may keep a secret, if two of them are dead. - Ben F.
Alternative to ulogd2, I'd suggest:
Add a 'prefix' to your logging rule(s) and you can build a syslog config off that.
Specify a 'level' in your logging rule(s).
Change the kernel.printk parameter in sysctl to not display the log levels that nft logs to in your console.
Jordan
________________________________________
From: Marco Moock <[email protected]>
Sent: Wednesday, November 20, 2024 3:06 PM
To: [email protected] <[email protected]> Subject: logging to a different place than kernel ring buffer
Hello!
I want to log denied traffic, but to syslog or a file rather than the kernel ring buffer because that messes up the virtual consoles.
What is a good way to achieve that?
--
Gruß
Marco
Send unsolicited bulk mail to [email protected]
A message that is not in the archive (sent off-list or not yet received): PH0PR05MB8159440DE55AAF8E8C6CFB9CB1212@PH0PR05MB8159.namprd05.prod.outlook.com
Am 20.11.2024 um 21:14:07 Uhr schrieb Jordan Dohms:
Quoted 2 lines
Change the kernel.printk parameter in sysctl to not display the log levels that nft logs to in your console.
This is what I've done without modifying the log level of the netfilter rules itself.
Mine are created via firewalld, so I will see if there is a way to change it there.
Signature · 4 lines
Gruß Marco Send unsolicited bulk mail to [email protected]