Pyrrhocoris apterus - fwLOGview
Table of Contents

Installation on the management machine

syslog

First you have to ensure syslog sends kernel messages to /var/log/fwlog/fwlog.FIFO.
Second make sure syslog accepts messages from remote firewalls (in distributed installation).

For syslog this could be done like:

  1. add kern.* |/var/log/fwlog/fwlog.FIFO to /etc/syslogd.conf
  2. to be able to receive logs from other machines make sure syslogd is started with option -r (/etc/sysconfig/syslog on Red Hat)
  3. restart syslogd

fwlogd

  1. unpack package to eg. /opt/fwlogview
  2. mkdir /var/log/fwlog
  3. mkfifo /var/log/fwlog/fwlog.FIFO
  4. copy fwlogd/fwlogd.startscript to /etc/init.d/fwlogd
  5. aktivate fwlogd for your runlevels (chkconfig –level 2345 fwlogd on RedHat)
  6. start fwlogd (/etc/init.d/fwlogd start)

fwlogmgmd

  1. package should already unpacked in eg. /opt/fwlogview
  2. copy fwlogd/fwlogmgmd.startscript to /etc/init.d/fwlogmgmd
  3. activate fwlogmgmd for your runlevels (chkconfig –level 2345 fwlogmgmd on RedHat)
  4. copy fwlogmgmd.conf to /etc/fwlogview/fwlogmgmd.conf
  5. adjust parameter for allowed fwlogview clients in fwlogmgmd.conf (only 127.0.0.1 is allowed by default)
  6. start fwlogmgmd (/etc/init.d/fwlogmgmd start)
  7. check installation with “telnet localhost port” which should welcome you to fwlogmgmd