No firewall log EFW 2.4-community

[Guest]

[strangetpwn]

It appears that firewall logging is not working on my fresh efw 2.4 community install.

No "hits" are being logged to file - the Live Log page is blank and the Firewall log viewer page displays the message "No (or only partial) logs exist for the given day: /var/log/firewall could not be opened" - Logging into the console confirms that no such /var/log/firewall file exists.

I tried to create a file using "touch firewall", but I'm not sure if this would be effective or if I set the permissions right, but the message did disappear.

I've tried to create situations that should create hits for the log file such a selecting "log accepted packets" and denying traffic from green>red on port 80, and the firewall itself is working, but without logging.

[ad.aimm]

hi,

i agree with you but i don't know how to fix it.

regards.

ad

[wavrunrx2]

same here, the firewall log is not logging anything.
(ive enabled the 'Log refused packets' tick) on the logs--->settings page.

endian-christain, any idea how to fix this ?

[necromanx]

I am having the same problem.

[ofernandez]

I'm the same problem.

[actaris]

yes, me too:
upgrade from a 2.3 box

[Maestrale]

Me too from  2.3 to 2.4

[schraads]

I did a fresh install of 2.4.0 Community and I am seeing the same problem.

Over at Endian bug tracker, they are seeing that ULOG refuses to start.

When checking the firewall logs, neither the live logs nor the firewall logs display any information. The /var/log/firewall is present but shows 0 bytes.

After checking the initial configuration, this seems to be a problem with ulog. It refuses to start. I tried to start it manually and the syslog file shows the following error message:

Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `NFLOG'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `ULOG'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `NFCT'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `IFINDEX'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `SYSLOG'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `BASE'
Mon May 31 16:48:06 2010 <5> ulogd.c:372 registering plugin `PRINTPKT'
Mon May 31 16:48:06 2010 <7> ulogd.c:721 cannot find key `ip.saddr.str' in stack
Mon May 31 16:48:06 2010 <7> ulogd.c:721 cannot find key `ip.saddr.str' in stack
Mon May 31 16:48:06 2010 <8> ulogd.c:1173 not even a single working plugin stack

[wavrunrx2]

this is a major issue in my mind; i need to see attempts at my network.
we need a fix fast.

[endian-christian]

Hello,

Thank you very much - we found the issue and created a new package.
You can try and download it here: http://public.endian.com/christian/ulogd-2.0.0-0.endian8.i586.rpm.

Regards,
Christian

[ad.aimm]

hi,

new rpm is in conflict with the old one : ulog-2.0.0-0.endian7.i586

even with --replacepkgs , i can't install it.

any idea ?

regards,

ad.

[strangetpwn]

hi,

new rpm is in conflict with the old one : ulog-2.0.0-0.endian7.i586

even with --replacepkgs , i can't install it.

any idea ?

regards,

ad.

Try

rpm -i --force

Don't forget to reboot

[endian-christian]

hi,

new rpm is in conflict with the old one : ulog-2.0.0-0.endian7.i586

even with --replacepkgs , i can't install it.

any idea ?

regards,

ad.

Try using smart

Code:

smart install ulogd-2.0.0-0.endian8.i586.rpm

[ad.aimm]

works with --force and firewall logs work too after this update

thx u

ad.

[actaris]

Tnx Christian,
I downloaded the rpm, transferred with WinSCP and installed with

Code:

smart install ulogd-2.0.0-0.endian8.i586.rpm

and the firewall's log now works without reboot!