On Thu, Jun 6, 2024 at 8:42 PM Marco Moock mm@dorfdsl.de wrote:
Am 06.06.2024 um 18:15:28 Uhr schrieb Freek de Kruijf:
There is rsyslog in which you can separate all kinds of messages. So you can put all messages that you indicated using firewalld into, i.e., the file /var/ log/firewall .
Does logging to rsyslog work when LogDenied=off is set? It annoys me that the logs flood the ttys, the location is irrelevant as long as I can access it in any way.
There seems to be some confusion.
Kernel places messages in the internal ring buffer. User space can fetch messages from this buffer (that is what dmesg or logging daemons like rsyslog do) and dispatch them as needed.
Kernel can also print messages above the defined level directly to console. it can be disabled (or at least, you can set the level to be higher than "warning" that is the default for netfilter logs). It does not impact the access to the kernel buffer in any way.
As mentioned earlier in this thread, there is PR to support NFLOG for denied logs. You will need a user space daemon to receive and dispatch these messages. To my best knowledge, systemd-journald does not support NFLOG; I do not know if rsyslog/syslog-ng do. So it will need yet another one logging daemon.
firewalld already supports NFLOG in custom rules (zone definition or rich rules). Maybe it is possible to add explicit rules that log would-be-denied packages. I have not looked into it.