From: Florian Westphal <fw@strlen.de>
To: azurit@pobox.sk
Cc: netfilter@vger.kernel.org
Subject: Re: nftables cgroup accounting problem
Date: Mon, 5 Oct 2020 11:34:59 +0200 [thread overview]
Message-ID: <20201005093459.GA5213@breakpoint.cc> (raw)
In-Reply-To: <20200930192755.Horde.ZHlzJB9_OgMvaVsNNXoPYcf@webmail.inetadmin.eu>
azurit@pobox.sk <azurit@pobox.sk> wrote:
> Hi,
>
> i'm migrating from iptables to nftables and i'm having problem with
> accounting using cgroups. Everything was working on iptables but is printing
> weird errors with nftables (chain 'accounting' exists):
>
> # mkdir /sys/fs/cgroup/net_cls,net_prio/12345
> # echo 0x000112345 > /sys/fs/cgroup/net_cls,net_prio/12345/net_cls.classid
> # nfacct add 12345
> # iptables -I accounting -m cgroup --cgroup 0x000112345 -m nfacct
> --nfacct-name 12345
> iptables: No space left on device.
>
> # uname -a
> Linux server 4.9.236 #2 SMP Thu Sep 17 16:32:19 CEST 2020 x86_64 GNU/Linux
> # iptables --version
> iptables v1.8.2 (nf_tables)
Use legacy version. 4.9 lacks several fixes that might account for
this. Also, there is no advantage of iptables-over-nft vs.
iptables-legacy except it avoids race conditions with parallel rule
updates (plus a few advantages of the greater flexibility of the
nf_tables framework, but that has almost no bearing a this time).
next prev parent reply other threads:[~2020-10-05 9:34 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-30 17:27 nftables cgroup accounting problem azurit
2020-10-05 6:16 ` azurit
2020-10-05 7:53 ` Daniel
2020-10-05 8:15 ` azurit
2020-10-05 9:08 ` Daniel
2020-10-05 9:11 ` azurit
2020-10-05 9:34 ` Florian Westphal [this message]
2020-10-05 10:32 ` azurit
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201005093459.GA5213@breakpoint.cc \
--to=fw@strlen.de \
--cc=azurit@pobox.sk \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox