Go to main content

Securing the Network in Oracle® Solaris 11.3

Exit Print View

Updated: April 2019
 
 

How to Set Up a Log File for IP Filter

By default, all log information for IP Filter is recorded by syslog. It is good practice to create a log file to record IP Filter traffic information separately from other data that might be logged in the syslog log file.

Before You Begin

You must assume the root role.

  1. Determine which system-log service instance is enabled.
    % svcs system-log
    STATE          STIME    FMRI
    disabled       13:11:55 svc:/system/system-log:rsyslog
    online         13:13:27 svc:/system/system-log:default

    Note -  If the rsyslog service instance is online, modify the rsyslog.conf file.
  2. Edit the /etc/syslog.conf file by adding the following two lines:
    # Save IP Filter log output to its own file 
    local0.debug             /var/log/log-name

    Note -  In your entry, use the Tab key, not the Spacebar, to separate local0.debug from /var/log/log-name. For more information, see the syslog.conf(4) and syslogd(1M) man pages.
  3. Create the new log file.
    # touch /var/log/log-name
  4. Refresh the configuration information for the system-log service.
    # svcadm refresh system-log:default

    Note -  Refresh the system-log:rsyslog service instance if the rsyslog service is enabled.
Example 24  Creating an IP Filter Log

The following example shows how to create ipmon.log to archive IP Filter information.

Edit the syslog.conf.

pfedit /etc/syslog.conf
## Save IP Filter log output to its own file
local0.debug<Tab>/var/log/ipmon.log

Then, on the command line, create the file and restart the service.

# touch /var/log/ipmon.log
# svcadm restart system-log