Re: Iptables logs on High bandwidth traffic network

[Mogens Valentin <monz@danbbs.dk>]

Taylor, Grant wrote:
>> Hi all,
>>         I am planning to implement iptables log feature on a server
>> machine(Dual xeon processor,Intel e100 cards,80GB SCSI and 2GB RAM)
>> which is running in bridge mode (On RH 7.3).The average traffic on this
>> machine is vary from 40-60Mbps.Hence I require some suggestion for some
>> my questions like,
>>
 > The reason that
> LOG is not meant for high volume logging is that it relies on SysLog to 
> log it's data which in and of it's self is not meant for high volume 
> longing.  SysLog will quite often become disk bound if you try to log 
> such high volumes to it and thus the system will sort of flounder...

How about using a fifo (man mkfifo and man syslog) and let syslog pipe 
to that fifo. Some program can then read from the fifo, parse data, and 
maybe use a database for storing the parsed, now more limited, data.
Might be a good ide to have the database on another system :-

-- 
Kind regards,
Mogens Valentin