iptables日志管理

目的：使系統單獨生産iptables的獨立日志，并且按每天記錄,達到IPtables滾動日志。

一、配置syslogd的配置檔案/etc/syslog.conf

在檔案syslog.conf裡添加如下内容

# Iptables logging

kern.debug /var/log/iptables

二、使用IPtables滾動日志

先檢視并确定logrotate的配置檔案/etc/logrotate.conf内容如下：

# see "man logrotate" for details

# rotate log files weekly weekly

# keep 4 weeks worth of backlogs rotate 4

# create new (empty) log files after rotating old ones create

# uncomment this if you want your log files compressed

#compress

# RPM packages drop log rotation information into this directory include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here /var/log/wtmp { monthly create 0664 root utmp rotate 1 }

# system-specific logs may be also be configured here.

然後在syslog的滾動日志配置檔案/etc/logrotate.d/syslog裡面添加IPtables的日志檔案/var/log/iptables，詳細内容如下：

/var/log/iptables /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {

sharedscripts

postrotate

/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true

endscript

}

最後安排logrotate每天執行一次，确定檔案/etc/cron.daily/logrotate内容如下：

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf

EXITVALUE=$?

if [ $EXITVALUE != 0 ]; then

/usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"

fi

exit 0

到此就完成了！