iptables and syslog: how to log in a separate file

I defintly hate to see iptables log entry in /var/log/syslog. No problem, syslog-ng just make my case. According to conflict relationships its installation will imply uninstallation of sysklogd and klogd packages: no problem, syslog-ng do everything and much more! Let's see how to configure it to put iptables logs in a separate file.

In your iptables rules you can specify a prefix to be added to each log entry. Here an example:

iptables -I INPUT -i eth1 -p tcp --dport 22 -j LOG --log-prefix MyIptablesPrefix:

Now that you can distinguish them, configure syslog-ng to put lines matching the prefix in a separate file. Just append the following lines to /etc/syslog-ng/syslog-ng.conf:

destination df_firewall {
file("/var/log/firewall.log");
};
filter f_firewall {
match("MyIptablesPrefix:");
};
log {
source(s_all);
filter(f_firewall);
destination(df_firewall);
};

Further, you may want to prevent syslog-ng from appending iptables log entries to /var/log/syslog, so adapt this line:

filter f_syslog { not facility(auth, authpriv) };

as follows:

filter f_syslog { not facility(auth, authpriv) and not match ("MyIptablesPrefix"); };