Compare the /etc/syslog.conf files from the other distributions to SuSEs. Probably kern.* are "wall(1)"ed.
My Debian 3.0 box: /etc/syslog.conf <snip> kern.* /var/log/firewall <snip> No extra Options for kern.* to tty are set. 44-10:/var/log# syslogd -v syslogd 1.4.1 My Red Hat 7.3 Box: /etc/syslog.conf <snip> kern.warn;*.err;authpriv.none /dev/tty10 kern.warn;*.err;authpriv.none |/dev/xconsole kern.* -/var/log/firewall <snip> [root@wt etc]# /sbin/syslogd -v syslogd 1.4.1 Both systems have latest packages for this distribution. Both use kernel 2.4.18.
I looked in the script but did not find any options which tell iptables to log to console. Is it maybe a patch from SuSE within iptables?
I don't think so. iptables logs always as facility kernel, with a chooseable level in the logging statement.
This is part of the logging options line. Philippe