iptables excess logging
Lloyd H. Meinholz
lloyd.meinholz at bmpcoe.org
Tue Oct 5 15:17:04 UTC 2004
Here is a link to a pretty good article on iptables:
<http://www.informit.com/articles/article.asp?p=169573>
It has some good info on logging and limiting it. It helped me quite a
bit.
Lloyd
On Tue, 2004-10-05 at 11:01, menonrr at jmu.edu wrote:
> Hello Mark,
>
> Thanks for the advice.
>
> But now I have a new problem. The syslog logs millions of such
> entries:
>
> Source and Destination to 127.0.0.1
>
> Oct 5 10:35:17 nessusClient kernel: INPUT packets:IN=lo OUT=
> MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
> DST=127.0.0.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=30292 DF
> PROTO=TCP SPT=631 DPT=34189 WINDOW=32754 RES=0x00 ACK URGP=0
>
> Source = various ; Destination to 255.255.255.0
>
> Oct 5 10:51:09 nessusClient kernel: INPUT eth1 Ext:IN=eth1
> OUT= MAC=ff:ff:ff:ff:ff:ff:00:08:74:ab:0d:27:08:00
> SRC=134.126.21.83 DST=255.255.255.255 LEN=68 TOS=0x00
> PREC=0x00 TTL=128 ID=39383 PROTO=UDP SPT=1226 DPT=7100 LEN=48
>
> Can you advise how to make the log less cumbersome
> (--log-level?) and not log unnecesary information like traffic
> from 127.0.0.1 or broadcasts?
>
> I am very thankful.
>
> Menon
More information about the redhat-list
mailing list