Thanks David but…

I have followed precisely your advises and It keeps on loging to /var/ log/messages instead of /var/log/sonic.log ??

*.*                         /var/log/sonic.log

Using tab instead and no spaces - restarting syslog - ??
I have also tried !firewall // no success //

My logs are coming from a remote host maybe this is the reason why it can't log to sonic.log ?

localhost -->

remote host -->

Any help would still be apreciated ?!?

Le 14 déc. 06 à 20:02, David Robillard a écrit :


I am trying to log my sonicwall FW log to a specific file…

For the moment all logs are sent to /var/log/messages

I would like them to go to /var/log/sonic.log

I have tried couple of things which does not seem to work, among them :

> local0.*           /var/log/sonic.log
> +@
--> not working

> local0.*           /var/log/sonic.log
--> not working either

In /var/log/messages my log are of that format :

> Dec 14 14:50:49 fw id=firewall sn=0006Bxxx4D6C time="2006-12-14
> 14:50:45" fw= pri=5 c=64 m=36 msg="TCP connection
> dropped" n=183
> proto=tcp/135

Any help would be welcome.

Try installing those two lines in your syslog.conf(5) file and make
sure you use TAB instead of spaces.

*.*                         /var/log/sonic.log

Then issue a `sudo touch /var/log/sonic.log` as the file must exist
before syslogd(8) can write to it (i.e. syslogd(8) does not create

After this run `sudo /etc/rc.d/syslogd restart` to instruct syslogd(8)
of the changes you've made to syslog.conf(5).

Finally, make sure you edit newsyslog.conf(5) with something like this
to keep your /var file system from filling up.

/var/log/sonic.log        www:wheel 640  7     100  *   J

man newsyslog.conf for more on newsyslog.conf(5)'s syntax.


David Robillard
UNIX systems administrator & Oracle DBA
CISSP, RHCE & Sun Certified Security Administrator
Montreal: +1 514 966 0122

Gregober ---> PGP ID --> 0x1BA3C2FD
bsd @at@

P "Please consider your environmental responsibility before printing this e-mail"

_______________________________________________ mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to