conntrack accounting

[Ben Lentz <BLentz@channing-bete.com>]

Greetings list!
I am considering using the conntrack-tools userspace package to perform 
byte level accounting for iptables by reading events from the connection 
tracking table for completed connections and logging the statistics for 
the stateful connection to syslog. It appears that conntrack was really 
designed to keep redundant firewalls' state tables in sync, but I'm 
intrigued by it's ability to use the new connection tracking and state 
notification features in netfilter without having to parse or poll 
/proc/net/ip_conntrack.

The goal I'm trying to accomplish is similar to that of:
conntrack -E conntrack -e DESTROY | logger -t conntrack &

which gives me the ability to log completed (e.g. entered the DESTROY 
state) connections to syslog from kernel-triggered events. It's plenty 
hackish though... it'd be nicer to have an actual daemon that fork()s 
and detaches and closes file descriptors and communicates with syslog 
directly. I understand that a patch has been contributed to allow 
conntrackd to use syslog, but it appears that the logging facility in 
conntrackd is limited to recording startup, shutdown, and error 
information. In any event, the current incarnation of conntrackd does 
not support the long-term recording of event messages.

What would you folks recommend to accomplish this goal? Am I simply 
using the wrong tool here, or is it worthwhile to get a-patchin'?

If more appropriate, I'll repost this in netfilter failover, but since 
I'm not actually looking to do failover (at the moment) I'd figure I'd 
start here.

Thanks in advance for any information or opinions you can provide.