Re: prevent iptables LOG target from flooding dmesg

[<lists@sterenborg.info>]

On Sat, 2010-06-05 at 23:42 +0300, Thanasis wrote:
> The subject says it all.
> I have set up logging like so :
> --------------------------------------------------------------------------------------------------------------------
> iptables -A INPUT -m state --state INVALID -j LOG --log-prefix "DROP
> INVALID " --log-ip-options --log-tcp-options
> iptables -A INPUT -i $INTIF ! -s $LAN -j LOG --log-prefix "SPOOFED PKT "
> iptables -A INPUT ! -i lo -j LOG --log-prefix "DROP " --log-ip-options
> --log-tcp-options
> iptables -A OUTPUT -m state --state INVALID -j LOG --log-prefix "DROP
> INVALID " --log-ip-options --log-tcp-options
> iptables -A OUTPUT ! -o lo -j LOG --log-prefix "DROP " --log-ip-options
> --log-tcp-options
> iptables -A FORWARD -m state --state INVALID -j LOG --log-prefix "DROP
> INVALID " --log-ip-options --log-tcp-options
> iptables -A FORWARD -i $INTIF ! -s $LAN -j LOG --log-prefix "SPOOFED PKT "
> iptables -A FORWARD ! -i lo -j LOG --log-prefix "DROP " --log-ip-options
> --log-tcp-options
> --------------------------------------------------------------------------------------------------------------------
> and dmesg is flooded by DROP log messages etc.
> I have NETFILTER_NETLINK_LOG [=m]
> in the kenel config, but I don't know how to use it,
> (and what the module name is).
> Any pointers/help will be much appreciated.

You can limit how much is logged with the 'limit' match. Doing this you
might lose some information but you might be okay with that. The 'limit'
match can be used like this:

$ipt [...] -m limit --limit 3/second [...]

However, I don't know if that's what you want.


--
Rob