Steffen Dettmer writes:

I would suggest to name this file "kernel" and not firewall, since IMHO "firewall" is misleading here. In a file firewall I wouldn't expect Harddisk I/O errors and so on. It's a pitty that syslog is to silly to sort by the tag field, but you could make a little (i.e. perl-) Script or some program doing this. Syslogd is able to write down to a named pipe, that could be read out be such a script. What do you think?

You could also have a look at syslog-ng, which can filter messages by various criteria (e. g. the message text itself). You can find it at http://www.balabit.hu/products/syslog-ng/ Regards, Ralph