ConfigServer Community Forum

Hi, on my RHEL v6.5 server CSF logs only one line per firewall hit in the systems /var/log/messages logfile.

But for some reason on a new Centos 7 server I'm setting up all logs are reproduced two times.
One time with a timestamp before the "Firewall: " part, the other directly as-is like on my Centos 6.5 system:
Note: I have disabled & uninstalled the systems "firewalld" daemon and am running only with iptables & I have the "net-tools" package installed.

That is down to your logging daemon configuration (probably rsyslogd or systemd), not csf as it is the kernel that does iptables logging.

I did a workaround for this now, on my old RHEL v6.5 server I was already moving the iptables logs into a separate file to not clutter /var/log/messages
I simply modified it to send the logs to a separate logfile like before, but also to discard the logs containing the timestamp: This goes into a new file called: /etc/rsyslog.d/iptables.conf
And then you need to create the logfile: "touch /var/log/iptables"
Finally rsyslog needs to be restarted: "systemctl restart rsyslog"

It's also useful to add rotation of the logfiles, just adding a new line into /etc/logrotate.d/syslog for the new logfile will be enough to get very basic rotation working.

And don't forget to set the new logfile location in /etc/csf/csf.conf:
IPTABLES_LOG = "/var/log/iptables"

Unlike version 6.5 of RHEL / Centos, version 7 was already set to only print console messages with a priority of 4 or higher, so there was no need to modify kernel.printk to get rid of the firewall messages otherwise printed on the console.

Quite soon after posting the above I figured out that the reason for the double logging was that I had enabled imklog in rsyslog.conf so I removed that. (And with it the last two lines in the code snippet above).
But I could not for the life of me remember why I had enabled it, but today I ran the csf "server check" mail and the eureka moment came:

Check for kernel logger
rsyslogd appears to be running, but klog may not be loaded which logs kernel firewall messages to rsyslog. You should modify /etc/rsyslogd to load the klog module with:
$ModLoad imklog
Then restart rsyslog