Re: [fwAnalog] fwanalog doesn't find messages

From: James Joyce (calipah~AT~free.fr)
Date: Tue Feb 08 2005 - 18:32:05 CET


Luca Pasquali wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
 > Hash: SHA1
>
>
> On Feb 7, 2005, at 10:49 PM, James Joyce wrote:
>
>> Hi people,
>>
>> I've just installed Fwanalog on a Gentoo distro. I uses syslog-ng for
>> logging facilities, and i run Shorewall that gives iptables logs
>> format stored in /var/log/messages.
>> When i run fwanalog.sh i receive the following error:
>
>
> iptables -A INPUT -i ppp0 -j LOG
>
> with ppp0 as the internet interface in this example is the recomended
rule
>

i've got set logging

>> merlin [~]: /etc/fwanalog/fwanalog.sh
>> fwanalog: No input files in the '/var/log' directory
>> named messages* and under 31 days old.
>>
>> soekris [~]: ls /var/log/mess*
>> -rw------- 1 root root 177K 07.02.2005 21:47:08 /var/log/messages
>
>
> excuse me, these seem two different hosts! anyway check what
> fwanalog.opts searchs.

my mistake, i changed the name but that's indeed what i get for the same host.
I've got my messages files full of iptables log but fwanalog doesn't find them

Here's a part of fwanalog.opts, it seems right to me

inputfiles_mask="messages*" # The name of your logfiles, with a wildcard if you want 

inputfiles_dir="/var/log"       # The directory where your logfiles are in,
                                                         #       e.g. 
/var/log
inputfiles_mtime="31"           # How old the logfiles can be
# You can change this to your log rotate interval + 1 day (so you never miss a logfile entry)
inputfiles=`find $inputfiles_dir -maxdepth 1 -name "$inputfiles_mask" -mtime -$inputfiles_mtime | sort -r`

This archive was generated by hypermail 2.1.5 : Thu Feb 10 2005 - 22:22:09 CET