Mysterious string "<4>" in LOG

Mysterious string "<4>" in LOG

[U.Mutlu]

Hello,

A mysterious string "<4>" gets prepended in LOG:
Rule:
  iptables -A INPUT  -m state --state INVALID -m limit --limit 7200/h -j LOG --log-prefix "INPUT INVALID "

Result (sanitized):
Sep 15 11:46:17 s7 kernel: [227009.792828] <4>INPUT INVALID IN=eth0 OUT= 
MAC=00:1b:21:ad:7b:d3:00:0c:db:4e:e8:00:08:00 SRC=**.210.155.237 DST=**.114.132.147 LEN=40 TOS=0x00 PREC=0x00 
TTL=52 ID=49676 PROTO=TCP SPT=6667 DPT=46271 WINDOW=0 RES=0x00 ACK SYN URGP=0

Happens with all LOG entries.
Is the string "<4>" in front of "INPUT INVALID" a new feature, or is it garbage due to a bug?


My system:

# iptables --version
iptables v1.4.14

# uname -a
Linux s7 3.6.0-rc5-my1 #1 SMP Wed Sep 12 19:22:44 CEST 2012 x86_64 GNU/Linux

# dpkg -l | grep -i iptables
ii  iptables                              1.4.14-3                   amd64        administration tools for 
packet filtering and NAT
ii  iptables-dev                          1.4.14-3                   amd64        iptables development files
ii  xtables-addons-common                 1.42-2                     amd64        Extensions targets and 
matches for iptables [tools, libs]
ii  xtables-addons-dkms                   1.42-2                     all          Extensions targets and 
matches for iptables
ii  xtables-addons-source                 1.42-2                     all          Extensions targets and 
matches for iptables [modules sources]

Re: Mysterious string "<4>" in LOG

[Marco Padovan]

http://www.spinics.net/lists/netfilter/msg53327.html

Il 15/09/2012 12:20, U.Mutlu ha scritto:
> Hello,
>
> A mysterious string "<4>" gets prepended in LOG:
> Rule:
>  iptables -A INPUT  -m state --state INVALID -m limit --limit 7200/h
> -j LOG --log-prefix "INPUT INVALID "
>
> Result (sanitized):
> Sep 15 11:46:17 s7 kernel: [227009.792828] <4>INPUT INVALID IN=eth0
> OUT= MAC=00:1b:21:ad:7b:d3:00:0c:db:4e:e8:00:08:00 SRC=**.210.155.237
> DST=**.114.132.147 LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=49676 PROTO=TCP
> SPT=6667 DPT=46271 WINDOW=0 RES=0x00 ACK SYN URGP=0
>
> Happens with all LOG entries.
> Is the string "<4>" in front of "INPUT INVALID" a new feature, or is
> it garbage due to a bug?
>
>
> My system:
>
> # iptables --version
> iptables v1.4.14
>
> # uname -a
> Linux s7 3.6.0-rc5-my1 #1 SMP Wed Sep 12 19:22:44 CEST 2012 x86_64
> GNU/Linux
>
> # dpkg -l | grep -i iptables
> ii  iptables                              1.4.14-3                  
> amd64        administration tools for packet filtering and NAT
> ii  iptables-dev                          1.4.14-3                  
> amd64        iptables development files
> ii  xtables-addons-common                 1.42-2                    
> amd64        Extensions targets and matches for iptables [tools, libs]
> ii  xtables-addons-dkms                   1.42-2                    
> all          Extensions targets and matches for iptables
> ii  xtables-addons-source                 1.42-2                    
> all          Extensions targets and matches for iptables [modules
> sources]
>
>
> -- 
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Mysterious string "<4>" in LOG

[U.Mutlu]

Thanks, but it's still confusing.
What steps are needed to disable this at user level?
Is a kernel recompilation necessary?


Marco Padovan wrote, On 09/15/2012 12:34 PM:
> http://www.spinics.net/lists/netfilter/msg53327.html
>
> Il 15/09/2012 12:20, U.Mutlu ha scritto:
>> Hello,
>>
>> A mysterious string "<4>" gets prepended in LOG:
>> Rule:
>>   iptables -A INPUT  -m state --state INVALID -m limit --limit 7200/h
>> -j LOG --log-prefix "INPUT INVALID "
>>
>> Result (sanitized):
>> Sep 15 11:46:17 s7 kernel: [227009.792828] <4>INPUT INVALID IN=eth0
>> OUT= MAC=00:1b:21:ad:7b:d3:00:0c:db:4e:e8:00:08:00 SRC=**.210.155.237
>> DST=**.114.132.147 LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=49676 PROTO=TCP
>> SPT=6667 DPT=46271 WINDOW=0 RES=0x00 ACK SYN URGP=0
>>
>> Happens with all LOG entries.
>> Is the string "<4>" in front of "INPUT INVALID" a new feature, or is
>> it garbage due to a bug?
<snip>