This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

logging question

This may have been answered elsewhere but i am unable to locate it at this junction with the forums search...

how can i log the traffic that was allowed...and ideally view it in realtime(via live log or something else) if i so choose? Accounting always winds up stopping itself(i gbet hte accounting is not running error and was informned that my network does not generate sufficient traffic for accounting to work correctly). I did setup my packet filter rule from accept to log accept..is this all i needed to do?

This thread was automatically locked due to age.

Parents

0 SecApp over 21 years ago

Astaro will have an ability to log packets on a rule basis for the pruposes of troubleshooting; but it's not released yet! So you can either load the tcpdump utility from the Astaro toolkit, and run ethereal on a workstation, or get a three port hub/tap and a laptop running the two (the latter being much easier...)
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 21 years ago in reply to SecApp

ick..i am wanting this for purposes of monitoring user's traffic in real-time(not interested in doing watching of rejected on a regular basis)...
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 21 years ago in reply to William Warren

hee is my rule i have setup
{ Private_Networks_-_RFC1918 } Any Any Log Allow

however the packet filter log still shows all the dropped stuff and hte log allow is not being shown in live log. Where would hte log of alowed stuff be hiding at?
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to William Warren

I told you; it doesn't do it yet...
Cancel
Vote Up 0 Vote Down

Cancel
0 firebear_01 over 21 years ago in reply to SecApp

Hi,
it shows in live log and in the packetfilter logs on my systems if i activate a rule with "log allow" the packets are logged with "action : accept" in livelog.

firebear
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 21 years ago in reply to firebear_01

will have to check that out..looks like i have to sift through all the drops that are logged...btw Astaro..maybe you could make logging drops a setting that can be turned off(but is on by default)?
Cancel
Vote Up 0 Vote Down

Cancel
0 firebear_01 over 21 years ago in reply to William Warren

Hi,
you can make this by yourself. Make a rule at the last position like this :
any -> any -> any -> drop
and turn this rule on or off everytime you need to do.

firebear
Cancel
Vote Up 0 Vote Down

Cancel
0 SecApp over 21 years ago in reply to firebear_01

Ooops; they slipped it in! Sorry I missed that...
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 21 years ago in reply to firebear_01

rofl...that means i would have to define all allowable traffic...actually i am admittedly using a much too powerful product for my purposes here at home...but i am also bringing up scenarios i may face when presenting to clients..[:)]
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 21 years ago in reply to William Warren

I look at my packet filter log and my kernel log and sure enough they are identical..filled with drops and not a single accepted entry..only after redefining the log accept rule a few tiems did it begin to show up..do not know for how long..i ahve all netbios blocked as drop not log drop yet they are showing up as dropped in both the kernel logs and the packet iflter logs(which are the same at least visibly)....any ideas on how to stop this?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 William Warren over 21 years ago in reply to William Warren

I look at my packet filter log and my kernel log and sure enough they are identical..filled with drops and not a single accepted entry..only after redefining the log accept rule a few tiems did it begin to show up..do not know for how long..i ahve all netbios blocked as drop not log drop yet they are showing up as dropped in both the kernel logs and the packet iflter logs(which are the same at least visibly)....any ideas on how to stop this?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 firebear_01 over 21 years ago in reply to William Warren

Hi,
if your rules are not right the default policy of your asl takes the packet and this is :
any - any - any - log drop
and puts every packet into your log.

firebear
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 21 years ago in reply to firebear_01

nod so i ahve to define all trafic to be simply dropped insead of hte default log drop. Okies...
Cancel
Vote Up 0 Vote Down

Cancel