System Log On Local/Remote Machines

Logs are an essential part of a security critical system like a firewall. Not only does it give out information in real time on what is happening on the system, but it also retraces its history, e.g. when something goes wrong in the system - a crash or an intrusion - it will find out why it happened and most generally figure out a solution.

First of all, you have the choice to activate (or not) the logging system on the local machine (the firewall itself). This, of course, will only be relevant if a display is directly attached to the firewalling machine. It will be possible to control:

Level info

This parameter controls the amount of info that will be displayed, from:

Which console do you want the log on? Console 12 (tty12)

Here, you can choose the virtual console on which some selected messages will be displayed, e.g. you can switch to Console 12 by pressing the keys (Ctrl-Alt-F12).


Then you can choose whether to log Reject Packet by the firewall. If you decides so, put the switch "on" and click on the "Audit specific traffic" button: , that will lead you to a form where you can choose the exact services to be audited.


Then, a suggestion will be made to have the logs sent to a log server. This is an interesting feature for machines likely to be attacked by intruders. Having logs stored on another machine will enable you to keep a secure copy of the logs less likely to be modified by crackers wanting to erase their tracks.

Machine to receive network logs (ex: 10.1.1.10) 192.168.1.11

This field holds the IP address of a possible syslog server on your secured network. To enable the server to receive logs from your firewall, you need to modify the file /etc/init.d/syslog. Simply replace the line "daemon syslogd -m 0" by "daemon syslogd -m 0 -r -l firewall". (provided your firewall is called "firewall")

Finally choose the amount of info that will be sent to the log server.