I have several applications that are potentially high-risk and high-throughput (like bind, ntpd, etc.). I plan on having a "management domain" for OS tasks, updates, SNMP, automation, etc. and a "service domain" that only includes the daemons I'm providing services with.
I've successfully created network namespaces for them, assigned dedicated IP addresses, discrete routes, etc. I would like to be able to use IPtables to log certain behaviors hitting the daemons within the namespaces (unique devices requesting recursive lookups on dns, etc.) but I can't get the "LOG" target in IPtables to work. I've tried running a syslog daemon inside the ns but it still doesn't work. It may want to write to the global filesystem and not be getting permitted. I'm somewhat new to namespaces, so any thoughts are appreciated.