ULOGD and other logs

ULOGD and other logs

[ratheesh k]

Hi ,

 I am using ulogd to   store iptables logs to /tmp/logfile.txt.  There
is an application ( say X ) running on userspace ( using nfqueue  in
FORWARD chain in filter table ) to do some kind of blocking  packets
based on time ( some  thing like a minimal parental control feature ).
I would also want to generate some logs and put into the same
/tmp/logfile.txt file.  Since  ulogd and  X are using same file , we
need some file locking mechanism. Is there any other way to forward
these message to netlink socket and ulogd can itself handle, so that i
dont have to do any kind of synchronization.

May be i can put the question in this way: Kernel is sending some
message and ulogd listens and receives the message on netlink socket.
Could any other application in userspace  , send some  message  to
this socket and ulogd can read and write to the log file f ?

Thanks,
Ratheesh

Re: ULOGD and other logs

[Pablo Neira Ayuso]

On 13/09/10 15:12, ratheesh k wrote:
> Hi ,
>
>   I am using ulogd to   store iptables logs to /tmp/logfile.txt.  There
> is an application ( say X ) running on userspace ( using nfqueue  in
> FORWARD chain in filter table ) to do some kind of blocking  packets
> based on time ( some  thing like a minimal parental control feature ).
> I would also want to generate some logs and put into the same
> /tmp/logfile.txt file.  Since  ulogd and  X are using same file , we
> need some file locking mechanism. Is there any other way to forward
> these message to netlink socket and ulogd can itself handle, so that i
> dont have to do any kind of synchronization.
>
> May be i can put the question in this way: Kernel is sending some
> message and ulogd listens and receives the message on netlink socket.
> Could any other application in userspace  , send some  message  to
> this socket and ulogd can read and write to the log file f ?

There's the UNIX plugin for ulogd2 (not yet in mainline) that Eric 
Leblond and Pierre Chifflier contributed time ago. However, some minor 
issues prevented to push into mainline, any word on it, Eric, Pierre?