Arch Linux

Malstrond

Member

From: Germany

Registered: 2009-06-03

Posts: 98

[SOLVED] Cannot set shorewall setting LOGFORMAT anymore

The log messages from the shorewall firewall normally look like this

Jun 24 00:03:38 localhost kernel: [259999.392752] Shorewall:net2fw:DROP:IN=ppp0 OUT= ...etc.

but then they suddenly changed to this

Jun 24 09:35:58 localhost kernel: [294338.885830] --log-prefixIN=ppp0 OUT= ...etc.

The LOGFORMAT variable, which is set to

LOGFORMAT="Shorewall:%s:%s:"

in shorewall.conf - the default - doesn't get used anymore, instead the literal iptables setting name gets used. This means I cannot discern which zone the packet had as its destination as easily anymore.
If I remove the setting altogether it stays the same, as it should, because it's the default.
If I use a static string, e.g. LOGFORMAT="Test", I get:

Jul  3 18:35:16 localhost kernel: [232119.344310] --IN=ppp0 OUT= ...etc.

The package updates that happend inbetween were:

[2012-06-24 00:05] upgraded archlinux-keyring (20120529-1 -> 20120622-1)
[2012-06-24 00:05] upgraded chrony (1.26-2 -> 1.26-3)
[2012-06-24 00:05] upgraded dcron (4.5-2 -> 4.5-3)
[2012-06-24 00:05] upgraded ddclient (3.8.1-3 -> 3.8.1-4)
[2012-06-24 00:05] Generating locales...
[2012-06-24 00:05]   de_DE.UTF-8... done
[2012-06-24 00:05]   de_DE.ISO-8859-1... done
[2012-06-24 00:05]   de_DE.ISO-8859-15@euro... done
[2012-06-24 00:05]   en_US.UTF-8... done
[2012-06-24 00:05]   en_US.ISO-8859-1... done
[2012-06-24 00:05] Generation complete.
[2012-06-24 00:05] upgraded glibc (2.15-11 -> 2.15-12)
[2012-06-24 00:05] upgraded device-mapper (2.02.95-6 -> 2.02.96-2)
[2012-06-24 00:05] installed liblqr (0.4.1-3)
[2012-06-24 00:05] upgraded imagemagick (6.7.7.5-1 -> 6.7.7.7-1)
[2012-06-24 00:05] upgraded iptables (1.4.13-1 -> 1.4.14-2)
[2012-06-24 00:05] upgraded libldap (2.4.31-2 -> 2.4.31-3)
[2012-06-24 00:05] upgraded krb5 (1.10.2-1 -> 1.10.2-2)
[2012-06-24 00:05] upgraded lm_sensors (3.3.2-2 -> 3.3.2-3)
[2012-06-24 00:05] upgraded openssh (6.0p1-2 -> 6.0p1-3)
[2012-06-24 00:05] upgraded smartmontools (5.42-3 -> 5.42-4)

iptables seems to be the only related update and the fact that "--log-prefix" is an iptables setting name leads me to believe some interaction with iptables is the problem. I don't understand the iptables changelog however.

Before I start reporting bugs, can anyone confirm this? It's happening to me on all my systems.

/Edit: Fixed in 1.4.15.

Last edited by Malstrond (2012-09-01 18:20:58)

fukawi2

Ex-Administratorino

From: .vic.au

Registered: 2007-09-28

Posts: 6,237

Website

Re: [SOLVED] Cannot set shorewall setting LOGFORMAT anymore

Check this:
https://bbs.archlinux.org/viewtopic.php?pid=1121360

---

Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?

BlueHackers // fscanary // resticctl

Malstrond

Member

From: Germany

Registered: 2009-06-03

Posts: 98

Re: [SOLVED] Cannot set shorewall setting LOGFORMAT anymore

Ah - should have searched for iptables, not for shorewall. Thanks.