Ставим syslog-ng
Code: Select all
apt-get install syslog-ng
Code: Select all
chkconfig syslog-ng on
chkconfig syslogd off
Code: Select all
#
# Описываем все сообщения за исключением iptables, news и mail:
filter f_messages { not facility(news, mail) and not filter(f_iptables); };
destination messages { file("/var/log/messages"); };
log { source(sys); filter(f_messages); destination(messages); };
#Тут описываем условия для снятия логов с фаервола (iptables) в файл:
filter f_iptables { facility(kern) and match("IN=") and match("OUT="); };
destination firewall { file("/var/log/iptables/firewall"); };
log { source(sys); filter(f_iptables); destination(firewall); };
Code: Select all
mkdir /var/log/iptables
chown root:adm /var/log/iptables
chmod 0750 /var/log/iptables
Code: Select all
service syslogd stop && service syslog-ng start