EFW Support

It appears that firewall logging is not working on my fresh efw 2.4 community install.

No "hits" are being logged to file - the Live Log page is blank and the Firewall log viewer page displays the message "No (or only partial) logs exist for the given day: /var/log/firewall could not be opened" - Logging into the console confirms that no such /var/log/firewall file exists.

I tried to create a file using "touch firewall", but I'm not sure if this would be effective or if I set the permissions right, but the message did disappear.

I've tried to create situations that should create hits for the log file such a selecting "log accepted packets" and denying traffic from green>red on port 80, and the firewall itself is working, but without logging.

hi,

i agree with you but i don't know how to fix it.

regards.

ad

same here, the firewall log is not logging anything.
(ive enabled the 'Log refused packets' tick) on the logs--->settings page.

endian-christain, any idea how to fix this ?

I am having the same problem.

I'm the same problem.

yes, me too:
upgrade from a 2.3 box

Me too from  2.3 to 2.4

I did a fresh install of 2.4.0 Community and I am seeing the same problem.

Over at Endian bug tracker, they are seeing that ULOG refuses to start.

When checking the firewall logs, neither the live logs nor the firewall logs display any information. The /var/log/firewall is present but shows 0 bytes.

After checking the initial configuration, this seems to be a problem with ulog. It refuses to start. I tried to start it manually and the syslog file shows the following error message:

Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `NFLOG'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `ULOG'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `NFCT'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `IFINDEX'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `SYSLOG'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `BASE'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `PRINTPKT'
Mon May 31 16:48:06 2010 <7> ulogd.c:721 cannot find key `ip.saddr.str' in stack
Mon May 31 16:48:06 2010 <7> ulogd.c:721 cannot find key `ip.saddr.str' in stack
Mon May 31 16:48:06 2010 <8> ulogd.c:1173 not even a single working plugin stack

this is a major issue in my mind; i need to see attempts at my network.
we need a fix fast.

Hello,

Thank you very much - we found the issue and created a new package.
You can try and download it here: http://public.endian.com/christian/ulogd-2.0.0-0.endian8.i586.rpm (http://public.endian.com/christian/ulogd-2.0.0-0.endian8.i586.rpm).

Regards,
Christian

hi,

new rpm is in conflict with the old one : ulog-2.0.0-0.endian7.i586

even with --replacepkgs , i can't install it.

any idea ?

regards,

ad.

Try

rpm -i --force

Don't forget to reboot

Try using smart

works with --force and firewall logs work too after this update

thx u

ad.

Tnx Christian,
I downloaded the rpm, transferred with WinSCP and installed with
and the firewall's log now works without reboot!

Thx again Christian.

For anyone else who comes across this post, the "smart" tool allows you to download the package before you install it, avoiding the use of scp as follows:


Of course, you can also bypass the download step and install directly from the URL as follows:


cooooool...

except, I had to omit the URL to the rpm Christian provided because I guess I am not allowed to post clickable links.  You'll just need to replace {some http url} with the links he gave.

Off topic, what is the convention for that sort of thing?

If you have registered on the Endian website under "Register EFW Community," you can SSH into your firewall and issue the "efw-upgrade" command. It will ask you for the email address you have registered on the site. Once I did that, it installed the updated package and fixed the firewall log issue.

Hi,

i also had the same problem, so i did the upgrade via smart, and the logging is working again, but within the livelog there is no port associated to the log entry. Only source and destination ip. Do you also have the same issue??

Thanks in advance,
regards
Herbert

Hi everyone,

It works for me using pscp (cause I dont have my linux here :'() and smart install.

Thank you all! ;D

Edit: I got everything working  :D

Does anyone have a working link for that package?

ulogd-2.0.0-0.endian8.i586.rpm

The the link to download the file is broken and smart / efw-upgrade do not work!   :-[

Could someone upload the ulogd rpm please?

***Resolved by registering and running efw-upgrade -s.

I agree, the link is broken.  I'd register and try doing it that way, but the registration link is also down.  I really need this working, can someone point me to the correct package?

I can't download the file, link is dead!!

*ttp://rapidshare.com/files/432817530/ulogd-2.0.0-0.endian8.i586.rpm

thank you  ;)

Hi!

mine, add plugin="/usr/lib/ulogd/ulogd_filter_IP2STR.so" to /etc/ulogd.conf and reboot.
Then everything work fine.

Hope it could help.
OHMM

at 2.4.1 this problem is solved...
try: efw-update -s