Can I have something like this:
iptables -A INPUT -i em1 -j LOG --log-prefix='iptables1: ' iptables -t nat -A PREROUTING -i em1 -j LOG --log-prefix='iptables2: '
Here I have different log files for each command. This would be very helpful if, for example, one wants to monitor only one event or ip or mac or port or whatever and just have that logged in one file rather than to filter the one big log to search for that specific event/ip/mac/whatever...
It does not seem to work, when I tried and I have not seen any examples anywhere that I can. Of course, I did have multiple .conf files corresponding to the prefixes specified in the /etc/rsyslog.d directory.
Logging to the same file does work. Can someone explain how the --log-prefix works? Does the last one override all previous specifications? Or are we supposed to get multiple log files as I expected? Or is it an error to provide multiple prefixes? I tried a few choice but there was no consistent answer.