Op donderdag 6 juni 2024 20:46:15 CEST schreef Eric Garver:
On Thu, Jun 06, 2024 at 07:42:42PM +0200, Marco Moock wrote:
Am 06.06.2024 um 18:15:28 Uhr schrieb Freek de Kruijf:
There is rsyslog in which you can separate all kinds of messages. So you can put all messages that you indicated using firewalld into, i.e., the file /var/ log/firewall .
Does logging to rsyslog work when LogDenied=off is set?
No. It has not been implemented.
I have logging on a server for the regular services on that server, so not logging of denied packages. This amounts up to around 11,000 lines per 24 hours in the log.
Apart from that server, I have a honeypot which gets all traffic to non- regular ports; only TCP. This amounts to around 15,000 lines per 24 hours in the log.
These logs are reported to the SANS institute (dshield.org).
It annoys me that the logs flood the ttys, the location is irrelevant as long as I can access it in any way.
In rsyslog you can prevent any logging to a tty.