Global logging limit

["Salih Gönüllü" <sag@open.ch>]

Hi,

I am trying to enforce a global logging limit on my rule set. I would to 
like to be able to refer log entries to the causing rule too.

Here is what I am thinking of:


-N LogLimit
-A LogLimit -m limit --limit 3333/sec --limitburst 3000 -m MARK 
--set-mark  $LOGGING_MARK
-A LogLimit -j RETURN

....

-A ruleid:7906::: -p tcp -m tcp --dport 21 -j LogLimit
-A ruleid:7906::: -m MARK --mark $LOGGIN_MARK -j NFLOG --nflog-group 2 
--nflog-prefix "DROP by 7906"
-A ruleid:7906::: DROP

....

-A ruleid:7910::: -p tcp -m tcp --dport 389 -j LogLimit
-A ruleid:7910::: -m MARK --mark $LOGGIN_MARK -j NFLOG --nflog-group 2 
--nflog-prefix "DROP by 7910"
-A ruleid:7910::: DROP


Would I be paying a lot in term of performance by sending all dropped 
packets to the LogLimit chain ? I am using ulogd2, would it be better to 
put the limit in ulogd2 ?

Regards,

   -salih