HP VPN Firewall Appliances System Management and Maintenance Configuration Guide

# Disable all modules from outputting log, trap, and debug information to channel loghost.

[Firewall] info-center source default channel loghost debug state off log state off

trap state off

To avoid output of unnecessary information, disable all modules from outputting log, trap, and

debug information to the specified channel (loghost in this example) before you configure the

output rule.

# Configure an output rule to output to the log host ARP and IP log information that has a severity

level of at least informational.

[Firewall] info-center source arp channel loghost log level informational state on

trap state off

[Firewall] info-center source ip channel loghost log level informational state on trap

state off

2. Configure the log host:

The following configurations were performed on Solaris which has similar configurations to the

UNIX operating systems implemented by other vendors.

a. Log in to the log host as a root user.

b. Create a subdirectory named Firewall in directory /var/log/, and then create file info.log in

the Firewall directory to save logs from the firewall.

# mkdir /var/log/Firewall

# touch /var/log/Firewall/info.log

c. Edit the file syslog.conf in directory /etc/ and add the following contents.

# Firewall configuration messages

local4.info /var/log/Firewall/info.log

In this configuration, local4 is the name of the logging facility that the log host uses to receive

logs. info is the informational level. The UNIX system records the log information that has a

severity level of at least informational to the file /var/log/Firewall/info.log.

NOTE:

Be aware of the following issues while editing file /etc/syslog.conf:

• Comments must be on a separate line and must begin with a pound sign (#).

• No redundant spaces are allowed after the file name.

• The logging facility name and the information level specified in the /etc/syslog.conf file must be

identical to those configured on the firewall by using the info-center loghost and info-center

source commands. Otherwise the log information might not be output properly to the log host.

d. Display the process ID of syslogd, kill the syslogd process, and then restart syslogd using the –r

option to make the new configuration take effect.

# ps -ae | grep syslogd

147

# kill -HUP 147

# syslogd -r &

Now, the system can record log information into the log file.