[CentOS] Iptables - flooding console

[cbulist at gmail.com]

On 7/20/2011 12:52 PM, Keith Roberts wrote:
> On Wed, 20 Jul 2011, cbulist at gmail.com wrote:
>
>> To: centos at centos.org
>> From: "cbulist at gmail.com"<cbulist at gmail.com>
>> Subject: Re: [CentOS] Iptables - flooding console
>>
>>
>>
>> On 7/20/2011 10:18 AM, Keith Roberts wrote:
>>> On Wed, 20 Jul 2011, cbulist at gmail.com wrote:
>>>
>>>> To: centos at centos.org
>>>> From: "cbulist at gmail.com"<cbulist at gmail.com>
>>>> Subject: [CentOS] Iptables - flooding console
>>>>
>>>> Hi,
>>>>
>>>> We are trying to track some specific rules using  LOG as target.
>>>> Everything is working well but the problem is that iptables is flooding
>>>> the console with LOG messages.
>>>> We tried --log level 4 on iptables rules but it didn't work.
>>>> We fixed the problem changing KLOGD_OPTIONS value in
>>>> /etc/sysconfig/syslog to:
>>>> KLOG_OPTIONS="-c 4"
>>>>
>>>> Is it the best option or we are missing something?
>>>>
>>>> Thanks in advance
>>> I had this problem as well. The firewall logs were being
>>> sent (tailed/tee'd ?) to the console, which is a pain if you
>>> are using mc or any other console application.
>>>
>>> To fix it on Centos 5.5/6 I just added the following
>>> to the top of the /etc/syslog.conf file.
>>>
>>> Deleted these lines as not in use:
>>>
>>> # Log all kernel messages to the console.
>>> # Logging much else clutters up the screen.
>>> #kern.*                       /dev/console
>>>
>>>
>>> Replaced with:
>>> # Log all firewall messages to a file.
>>> kern.=debug      /var/log/firewall-log
>>>
>>> Obviously you need to make sure the firewall log file
>>> exists
>>>
>>> -rw-r--r--  keith  users    39039 Jul 20 15:24 firewall-log
>>>
>>> Kind Regards,
>>>
>> Thanks  Keith,
>>
>> I tried your solution but it didn't work. (man 8 syslogd describes what
>> you said)
>> First I returned the default value on KLOG_OPTIONS, I restarted the
>> syslog service but the iptables still continuous sending the log to console.
>> I forget mention the info system:
>>
>> CentOS 5.6
>>
>> [root at server_56 ~]# uname -r
>> 2.6.18-238.el5
>> [root at server_56 ~]# iptables -V
>> iptables v1.3.5
> OK Julio.
>
> There was a kernel update last night, so here's what my 5.6
> box has got on it:
>
> [root at karsites ~]# uname -r
> 2.6.18-238.19.1.el5
>
> [root at karsites ~]# iptables -V
> iptables v1.3.5
>
> my /etc/sysconfig/syslog file is untouched by me:
>
> ###################
>
> # Options to syslogd
> # -m 0 disables 'MARK' messages.
> # -r enables logging from remote machines
> # -x disables DNS lookups on messages recieved with -r
> # See syslogd(8) for more details
> SYSLOGD_OPTIONS="-m 0"
> # Options to klogd
> # -2 prints all kernel oops messages twice; once for klogd
> to decode, and
> #    once for processing with 'ksymoops'
> # -x disables all klogd processing of oops messages entirely
> # See klogd(8) for more details
> KLOGD_OPTIONS="-x"
> #
> SYSLOG_UMASK=077
> # set this to a umask value to use for all log files as in
> umask(1).
> # By default, all permissions are removed for "group" and
> "other".
>
> #################
>
> The only file I alter is /etc/syslog.conf which contains:
>
> #################
>
> # Log all firewall messages to a file.
> kern.=debug        /var/log/firewall-log
>
> # Log anything (except mail) of level info or higher.
> # Don't log private authentication messages!
> *.info;mail.none;authpriv.none;cron.none  /var/log/messages
>
> # The authpriv file has restricted access.
> authpriv.*         /var/log/secure
>
> # Log all the mail messages in one place.
> mail.*            -/var/log/maillog
>
> # Log cron stuff
> cron.*            /var/log/cron
>
> # Everybody gets emergency messages
> *.emerg           *
>
> # Save news errors of level crit and higher in a special file.
> uucp,news.crit   /var/log/spooler
>
> # Save boot messages also to boot.log
> local7.*         /var/log/boot.log
>
> #################
>
> and my IPtables rules for logging packets are:
>
> #------------------------------------------------------#
> # create a new chain for apache connections
> #------------------------------------------------------#
>
>    iptables -N open_port_80
>
> # LOG all local connections to apache port 80
>    iptables -A open_port_80 ! -i eth0 -p tcp --dport 80 \
>      -j LOG --log-level 7 --log-prefix 'Local Port 80 connects '
>
> # ACCEPT all local connections to apache port 80
>    iptables -A open_port_80 ! -i eth0 -p tcp --dport 80 -j
> ACCEPT
>
> #------------------------------------------------------#
>
> Here's what I get in my firewall-log file. Just did a
> connect from localhost to check it's all working OK.
>
> Jul 20 18:47:07 karsites kernel: Local Port 80 connects
> IN=lo OUT= MAC=00:00
> :00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
> DST=127.0.0.1 LEN=52 TOS=
> 0x00 PREC=0x00 TTL=64 ID=40422 DF PROTO=TCP SPT=59791 DPT=80
> WINDOW=386 RES=
> 0x00 ACK FIN URGP=0
>
> Maybe you need to take another look at your IPtables logging
> rule?
>
> Kind Regards,
>
> Keith
>
> -----------------------------------------------------------------

Keith and Daniel,

Thanks so much for your help!.

Keith you are right. I had --log-level 4 in the iptables rules because I 
played with that option in order to fix the problem. Now, it's working well.
I didn't update the kernel.

Sincerely,

Julio