How to Set Up a Log File for IP Filter

By default, all log information for IP Filter is recorded by syslog. It is good practice to create a log file to record IP Filter traffic information separately from other data that might be logged in the syslog log file.

Before You Begin

You must assume the root role.

1. Determine which system-log service instance is enabled.

   % svcs system-log
   STATE          STIME    FMRI
   disabled       13:11:55 svc:/system/system-log:rsyslog
   online         13:13:27 svc:/system/system-log:default

   ---

   Note -  If the rsyslog service instance is online, modify the rsyslog.conf file.

   ---

2. Edit the /etc/syslog.conf file by adding the following two lines:

   # Save IP Filter log output to its own file 
   local0.debug             /var/log/log-name

   ---

   Note -  In your entry, use the Tab key, not the Spacebar, to separate local0.debug from /var/log/log-name. For more information, see the syslog.conf(4) and syslogd(1M) man pages.

   ---

3. Create the new log file.

   # touch /var/log/log-name

4. Refresh the configuration information for the system-log service.

   # svcadm refresh system-log:default

   ---

   Note -  Refresh the system-log:rsyslog service instance if the rsyslog service is enabled.

   ---

Example 5-16  Creating an IP Filter Log

The following example shows how to create ipmon.log to archive IP Filter information.

Edit the syslog.conf.

pfedit /etc/syslog.conf
## Save IP Filter log output to its own file
local0.debug<Tab>/var/log/ipmon.log

Then, on the command line, create the file and restart the service.

# touch /var/log/ipmon.log
# svcadm restart system-log