1

Can I have something like this:

 iptables -A INPUT -i em1 -j LOG --log-prefix='iptables1: '
 iptables -t nat -A PREROUTING -i em1 -j LOG --log-prefix='iptables2: '

Here I have different log files for each command. This would be very helpful if, for example, one wants to monitor only one event or ip or mac or port or whatever and just have that logged in one file rather than to filter the one big log to search for that specific event/ip/mac/whatever...

It does not seem to work, when I tried and I have not seen any examples anywhere that I can. Of course, I did have multiple .conf files corresponding to the prefixes specified in the /etc/rsyslog.d directory.

Logging to the same file does work. Can someone explain how the --log-prefix works? Does the last one override all previous specifications? Or are we supposed to get multiple log files as I expected? Or is it an error to provide multiple prefixes? I tried a few choice but there was no consistent answer.

2

Use double quotes:

iptables -A INPUT -i em1 -j LOG --log-prefix="iptables1: "
iptables -t nat -A PREROUTING -i em1 -j LOG --log-prefix="iptables2: "

What log-prefix mean:

--log-prefix - When logging, put this text before the log message. Use double quotes around the text to use.

Source

  • Yes, the double-quotes worked. Thanks – Sunny Apr 27 '15 at 10:20
  • I have a funny situation. When I comment out one of the iptables line, flush the iptables rules and then start the script with the two lines above, it still continues to log to the commented file also! I checked with iptables -L and it did not have the log entry!! I restarted the rsyslog service too and that too did not change anything. Any possible explanation? – Sunny Apr 27 '15 at 11:43
  • @Samir In order to avoid chaos here, you should open a new question. :) – A.B. Apr 27 '15 at 11:44
  • Fair enough. I will do that. – Sunny Apr 27 '15 at 11:57
  • Gefundenes Fressen! ;-) – Fabby Aug 22 '15 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.