At 08:48 PM 4/13/2007, you wrote:
"Janos Dohanics" <[EMAIL PROTECTED]> wrote:
> I'm trying capture logs from m0n0wall, but the log file is empty.
> Here is my configuration:
> On the logging machine, in /etc/rc.conf:
> syslogd_flags="-a"
> In /etc/syslog.conf:
> +
> *.*                                             /var/log/m0n0wall.log
> /var/log/m0n0wall.log exists and writable:
> -rw-rw-r--  1 root  network  0 Apr 13 00:32 /var/log/m0n0wall.log
> The m0n0wall is configured to send logs to, which is the
> logging machine.
> What am I missing?

Start with tcpdump on the receiving machine:
tcpdump 'port 514'
to see if you're even receiving messages from the monowall machine.

If not, then double-check your config on the monowall machine.  If so,
check the receiving machine.

Did you restart syslogd on both systems after making config changes?

My apologies to everyone trying to help me for wasting their time - is happily logging what is sending. is being logged to /var/log/messages (finally occurred to me to check that).

What I'm wondering now is that why is not being logged in /var/log/m0n0wall.log? Here is my /etc/syslog.conf:

*.err;kern.warning;auth.notice;mail.crit                /dev/console
*.notice;authpriv.none;kern.debug;;mail.crit;news.err /var/log/messages
security.*                                      /var/log/security;                         /var/log/auth.log                                       /var/log/maillog                                        /var/log/lpd-errs                                        /var/log/xferlog
cron.*                                          /var/log/cron
*.=debug                                        /var/log/debug.log
*.emerg                                         *
# uncomment this to log all writes to /dev/console to /var/log/console.log                                   /var/log/console.log
# uncomment this to enable logging of all log messages to /var/log/all.log
# touch /var/log/all.log and chmod it to mode 600 before it will work
#*.*                                            /var/log/all.log
# uncomment this to enable logging to a remote loghost named loghost
#*.*                                            @loghost
# uncomment these if you're running inn
# news.crit                                     /var/log/news/news.crit
# news.err                                      /var/log/news/news.err
# news.notice                                   /var/log/news/news.notice
*.*                                             /var/log/slip.log
*.*                                             /var/log/ppp.log
*.*                                             /var/log/m0n0wall.log

Janos Dohanics

_______________________________________________ mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to