Messages in this thread | | | Date | Thu, 18 Dec 2014 15:23:23 +0100 | From | Toralf Förster <> | Subject | iptables LOG syslog timestamps delayed by about 6 minutes |
| |
[@balabit ML: pls Cc: me I'm not subscribed]
It looks a little bit odd to me, that this rule :
$IPT -t filter -A INPUT --match limit --limit 1/second --limit-burst 10 -j LOG --log-prefix "MYFW4 "
logs timestamps which are delayed about 6 minutes wrt to other log messages (for comparisation I made a $>logger "huhu") :
# grep -B 1 -A 1 huhu /var/log/messages Dec 18 15:04:09 tor-relay kernel: PORTSCAN 80 <scrubbed> Dec 18 15:10:01 tor-relay tfoerste[15080]: huhu Dec 18 15:04:09 tor-relay kernel: PORTSCAN 80 <scrubbed>
Yesterday the delay was about 5 minutes - so the delay increases over time. I restarted/reloaded both syslogd and the firewall script few times + activated/deactivated the logging rule. FWIW I do have these rules for syslog defined :
-------------------------------------------------------------------------------- destination d_myfw { file("/var/log/myfw/ipv4.log"); }; destination d_portscan { file("/mnt/ramdisk/portscan"); };
rewrite r_scrubb_ip { subst('\b(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\b', "scrubbed", value("MESSAGE"), type("pcre"), flags("global")); }; rewrite r_truncate { subst(' IN=.*', "", value("MESSAGE"), type("pcre"), flags("global")); };
filter f_myfw { match("MYFW4 " value("MSG")); }; filter f_messages { not match("MYFW4 |PORTSCAN " value("MSG")); }; filter f_portscan { match("PORTSCAN " value("MSG")); };
log { source(src); filter(f_myfw); destination(d_myfw); }; log { source(src); filter(f_portscan); rewrite(r_scrubb_ip); destination(d_portscan); }; log { source(src); filter(f_portscan); rewrite(r_truncate); destination(d_portscan); };
#log { source(src); filter(f_messages); destination(messages); }; log { source(src); destination(messages); }; log { source(src); filter(f_messages); destination(console_all); }; --------------------------------------------------------------------------------
The system is a 64 bit hardened Gentoo Linux w/ kernel 3.17.6 and syslog-ng 3.6.1
-- Toralf pgp key: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 0076 E94E
| |