Chris Walker's Blog

Ever had that moment when you notice something in a system is horribly flawed and no one seems to think that what you want to do is worth while? you know what I have to say to that?

Follow up:

First, you need to make an rsyslog config file for your iptables. Note, this should be done as root.

cd /etc/rsyslog.d;
<your editor> iptables.conf

in this iptables.conf:

:msg, contains, "[IPTABLES]Incoming Rejected: " /var/log/iptables/incoming.log
:msg, contains, "[IPTABLES]Outgoing Rejected: " /var/log/iptables/outgoing.log
& ~


Modify the portion in " " to your iptables --log-prefix information (this allows you to make multiple instances as I did above). Next we make a logrotate function, a 700mb log file is no fun eh?

cd /etc/logrotate.d/;
<your editor> iptables


In this file:

/var/log/iptables/*.log {
daily
missingok
rotate 6
compress
delaycompress
notifempty
create 640 root adm
sharedscripts
}


save and exit, be sure you run /etc/init.d/rsyslog restart after this.

I'll break it down later... this is good enough for now, providing you have incoming and outgoing iptables --log-prefix setup differently you can maintain any number of different log files, you can even go as far as port and further to make each their own log file, this organization can be very useful. If you want to know more about rsyslog and logrotate, man rsyslog and man logrotate are where I pulled most of my information, also notedly you can use any number of the files in logrotate to see how logrotate works, unfortunately, the only way to see rsyslog configs are in the /etc/rsyslog.conf, I may post a nice one for logrotate on sub directories and keeping subdomain access files separated.

Enjoy!