Subject: [alpine-devel] Shorewall Logs

From: Steve Fink <[email-masked]>
Date: Mon, 3 Jan 2011 07:37:12 -0700 (MST)

Where are the Shorewall logs stored? 

The Start/Stop/Restart info is written to /var/log/messages but I'm looking for the dropped packets and such. 

I've gone through the mailing list archives and cannot find any info. 

I've done some digging and see that this version of syslogd does not look at the syslog.conf I'm assuming that because they're kernel messages they're being handled by klogd but can't find where they're being written to. 

Thanks, 

Steve

---

From: Leonardo Arena <[email-masked]>
Date: Mon, 3 Jan 2011 16:05:00 +0100

On Mon, Jan 3, 2011 at 3:37 PM, Steve Fink <[email-masked]> wrote:
> I've done some digging and see that this version of syslogd does not look at
> the syslog.conf I'm assuming that because they're kernel messages they're
> being handled by klogd but can't find where they're being written to.
> Thanks,
> Steve

Busybox syslog writes everything in /var/log/messages. It does not
support separated logfiles by facility.
So, your firewall logs should be there, provided that you have enable
logging of dropped/rejected packets in shorewall.

Regards,

- leonardo

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Harry Lachanas <[email-masked]>
Date: Mon, 03 Jan 2011 17:17:50 +0200

> Where are the Shorewall logs stored?
In alpine they are sent to /var/log/messages
> The Start/Stop/Restart info is written to /var/log/messages but I'm 
> looking for the dropped packets and such.
>
Do you have any dropped packets and enabled log in shorewall conf ??
> I've done some digging and see that this version of syslogd does not 
> look at the syslog.conf I'm assuming that because they're kernel 
> messages they're being handled by klogd but can't find where they're 
> being written to.
>
in order to log to /var/log/shorewall.log you have to load and config ulogd
The documetation is in  shorewall site.
Cheers

---

From: Steve Fink <[email-masked]>
Date: Mon, 3 Jan 2011 09:05:07 -0700 (MST)

Thanks for the replies. 

I had guessed that everything was going to /var/log/messages but wasn't sure. 

I looked through all of the log options in shorewall.conf and they all looked correct so I kept digging. 

In the file /etc/shorewall/policy is where the DROP policy is defined and I had failed to add the log level of "info". 

Thanks again for your help! 

Best, 

Steve