After upgrading to IPF 203 DNS firewall hits can’t be monitored with
cat /var/log/messages | grep unbound
Probably this has to do with the switch from unbound to knot as DNS resolver. But also command
cat /var/log/messages | grep knot
does not give the DNS firewall hits like it’s used to be with IPF < 203.
Any idea how to monitor firewall hits with command line tools would be really appreciated.
The line for the system logs that looks for all related DNS log entries is the following
'dns' => '(knot_resolver.*: |supervisord: |kresd\[.*\]: |unbound: \[.*?\])',
so your script should look for similar entries. unbound is still included so that looking for older logs will still show the unbound logs as well as the knot related ones after the changeover.
Thankx a lot, this was the missing piece of information