'\" t
.\"     Title: IPSEC_BARF
.\"    Author: Paul Wouters
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\"      Date: 06/11/2019
.\"    Manual: Executable programs
.\"    Source: libreswan
.\"  Language: English
.\"
.TH "IPSEC_BARF" "8" "06/11/2019" "libreswan" "Executable programs"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
ipsec_barf \- spew out collected IPsec debugging information
.SH "SYNOPSIS"
.HP \w'\fBipsec\fR\ 'u
\fBipsec\fR \fIbarf\fR [\-\-short]
.SH "DESCRIPTION"
.PP
\fIBarf\fR
outputs (on standard output) a collection of debugging information (contents of files, selections from logs, etc\&.) related to the IPsec encryption/authentication system\&. It is primarily a convenience for remote debugging, a single command that packages up (and labels) all information that might be relevant to diagnosing a problem in IPsec\&.
.PP
The
\fB\-\-short\fR
option limits the length of the log portion of
\fIbarf\fR\*(Aqs output, which can otherwise be extremely voluminous if debug logging is turned on\&.
.PP
\fB\-\-maxlines <100>\fR
option sets the length of some bits of information, currently netstat \-rn\&. Useful on boxes where the routing table is thousands of lines long\&. Default is 100\&.
.PP
On systems with systemd, ipsec barf will look for logs using the journalctl command\&. If the logfile= option is used, logs will also not be found by the ipsec barf command\&.
.PP
\fIBarf\fR
censors its output, replacing keys and secrets with brief checksums to avoid revealing sensitive information\&.
.PP
Beware that the output of both commands is aimed at humans, not programs, and the output format is subject to change without warning\&.
.PP
\fIBarf\fR
has to figure out which files in
/var/log
contain the IPsec log messages\&. It looks for KLIPS and general log messages first in
\fImessages\fR
and
\fIsyslog\fR, and for Pluto messages first in
\fIsecure\fR,
\fIauth\&.log\fR, and
\fIdebug\fR\&. In both cases, if it does not find what it is looking for in one of those \(lqlikely\(rq places, it will resort to a brute\-force search of most (non\-compressed) files in
/var/log\&.
.SH "FILES"
.sp
.if n \{\
.RS 4
.\}
.nf
/proc/net/*
/var/log/*
/etc/ipsec\&.conf
/etc/ipsec\&.secrets
.fi
.if n \{\
.RE
.\}
.SH "HISTORY"
.PP
Written for the Linux FreeS/WAN project <\m[blue]\fBhttps://www\&.freeswan\&.org\fR\m[]> by Henry Spencer\&.
.SH "BUGS"
.PP
\fIBarf\fR
uses heuristics to try to pick relevant material out of the logs, and relevant messages that are not labelled with any of the tags that
\fIbarf\fR
looks for will be lost\&. We think we\*(Aqve eliminated the last such case, but one never knows\&.\&.\&.
.PP
Finding
\fIupdown\fR
scripts (so they can be included in output) is, in general, difficult\&.
\fIBarf\fR
uses a very simple heuristic that is easily fooled\&.
.PP
The brute\-force search for the right log files can get expensive on systems with a lot of clutter in
/var/log\&.
.SH "AUTHOR"
.PP
\fBPaul Wouters\fR
.RS 4
placeholder to suppress warning
.RE