3

I log all dropped packets using following iptables rule:

-A INPUT -j LOG --log-prefix "FW_DROP: " --log-level 7

and then in rsyslog.conf, I redirect this output to a separate file, so that my syslog is not flooded

:msg, contains, "FW_DROP" -/var/log/firewall.log
& ~

This works for syslog, but my dmesg still gets flooded with the fw messages, which drives me crazy. Would anybody know how to prevent this?

user1968963
  • 101
  • 1
  • 5

2 Answers2

2

Sorry, no. All logged messages are viewable with dmesg in the order in which they were received, subject to the size of its ring buffer. If you need to view recent log entries, without seeing firewall logs, use the actual logs where the entries are being stored.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
2

Install the Netfilter logging daemon (apt install ulogd2 for Debian based systems)

In your iptables rules:

  • replace -j LOG with -j NFLOG
  • replace --log-prefix "..." with --nflog-prefix "..."
  • check /etc/ulogd.conf for other settings you might want to change (like the log file, which is "/var/log/ulog/syslogemu.log" by default on Debian)
mivk
  • 4,004
  • 3
  • 37
  • 32