iptables 日志维护的方法分享

时间:2014-09-06 02:07 来源:linux.it.net.cn 作者:it

linux中iptables日志维护的具体方法

一、首先，配置syslogd的配置文件/etc/syslog.conf
在文件syslog.conf中添加：

复制代码代码示例:

	# Iptables logging

	kern.debug /var/log/iptables

二、使用IPtables滚动日志
查看并确定logrotate的配置文件/etc/logrotate.conf内容：

复制代码代码示例:

	# see "man logrotate" for details 

	# rotate log files weekly weekly 

	# keep 4 weeks worth of backlogs rotate 4 

	# create new (empty) log files after rotating old ones create 

	# uncomment this if you want your log files compressed 

	#compress 

	# RPM packages drop log rotation information into this directory include /etc/logrotate.d 

	# no packages own wtmp -- we'll rotate them here /var/log/wtmp { monthly create 0664 root utmp rotate 1 }

	# system-specific logs may be also be configured here.

然后，在syslog的滚动日志配置文件/etc/logrotate.d/syslog中，添加IPtables的日志文件/var/log/iptables：

复制代码代码示例:

	/var/log/iptables /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {

	    sharedscripts

	    postrotate

	    /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true

	    endscript

	}

最后，在logrotate中设置每天执行一次。
文件/etc/cron.daily/logrotate的内容如下：

复制代码代码示例:

	#!/bin/sh

	/usr/sbin/logrotate /etc/logrotate.conf

	EXITVALUE=$?

	if [ $EXITVALUE != 0 ]; then

	    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"

	fi

	exit 0

(责任编辑：IT)