iptables LOG actio writes to STDOUT

Question

when I use LOG action in some chane of iptables rules, I get the output both in STDOUT or STDERR of the xm console and in /var/log/messages.

Is there way to make iptables to write only to log without writing to console?

Thank you for ahead.

Ignacio Vazquez-Abrams · Answer 1 · 2010-08-25 10:51:42Z

up vote 2 down vote accepted

Pursuant to Sirex's answer, you can suppress syslog output to the console from all programs with dmesg -n 1.

answered Aug 25 '10 at 10:51

This is what I need – Rodnower Aug 25 '10 at 12:31

feedback

Sirex · Answer 2 · 2010-08-25 10:30:02Z

up vote 2 down vote

change the logged level of the iptables rule to "info".

for example:

/usr/sbin/iptables -A INPUT -j LOG --log-prefix "FIREWALL:INPUT " --log-level info

answered Aug 25 '10 at 10:30

Sirex
3,8431616

	Thank you for reply, but I don't want to change the log level of iptables messages. I think that better is to say directly to dmesg to not write errors (only panic) messages to console like Ignacio suggesting. – Rodnower Aug 25 '10 at 12:34
	ok. Its just that the default log level includes the console due to your default syslog settings. 'info' level does not. - whatever floats your boat :) – Sirex Aug 25 '10 at 14:10

feedback

cYrus · Answer 3 · 2010-08-25 10:41:20Z

up vote 0 down vote

You can try to redirect stdout and stderr to the null device:

iptables ... &> /dev/null

answered Aug 25 '10 at 9:41

cYrus
4,7111518

	In which stage? this command run ones and it's process die... For the point I get it on xm terminal – Rodnower Aug 25 '10 at 9:58
	Well, the string ` > /dev/null` after a command in many shells makes sure that this command doesn't produce any output. So you must write it after the command into your console (or script). If you tell me what command it is I can be more accurate. – cYrus Aug 25 '10 at 10:25
	I know what > /dev/null means :), but iptables is only command that starts, do something and go from memory out. I get the errors, I guess, from other processes. Any way I do for example: iptables -A SERVER_RULES -j LOG. I beleave that you understand that iptables -A SERVER_RULES -j LOG 2>&1 /dev/null will not prevent system from writing to console the messages I told about. – Rodnower Aug 25 '10 at 10:31
	Sorry, I can't figure out how such other processes can write to your console, in this case. – cYrus Aug 25 '10 at 10:50
	The logging happens at the kernel level. The `iptables` executable merely frobs the in-kernel tables. – Ignacio Vazquez-Abrams Aug 25 '10 at 10:52

feedback

3 Answers