lkml.org 
[lkml]   [2014]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectiptables LOG syslog timestamps delayed by about 6 minutes
[@balabit ML: pls Cc: me I'm not subscribed]

It looks a little bit odd to me, that this rule :

$IPT -t filter -A INPUT --match limit --limit 1/second --limit-burst 10 -j LOG --log-prefix "MYFW4 "

logs timestamps which are delayed about 6 minutes wrt to other log messages (for comparisation I made a $>logger "huhu") :

# grep -B 1 -A 1 huhu /var/log/messages
Dec 18 15:04:09 tor-relay kernel: PORTSCAN 80 <scrubbed>
Dec 18 15:10:01 tor-relay tfoerste[15080]: huhu
Dec 18 15:04:09 tor-relay kernel: PORTSCAN 80 <scrubbed>

Yesterday the delay was about 5 minutes - so the delay increases over time. I restarted/reloaded both syslogd and the firewall script few times + activated/deactivated the logging rule. FWIW I do have these rules for syslog defined :


--------------------------------------------------------------------------------
destination d_myfw { file("/var/log/myfw/ipv4.log"); };
destination d_portscan { file("/mnt/ramdisk/portscan"); };


rewrite r_scrubb_ip {
subst('\b(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\b',
"scrubbed", value("MESSAGE"), type("pcre"), flags("global"));
};
rewrite r_truncate {
subst(' IN=.*', "", value("MESSAGE"), type("pcre"), flags("global"));
};


filter f_myfw { match("MYFW4 " value("MSG")); };
filter f_messages { not match("MYFW4 |PORTSCAN " value("MSG")); };
filter f_portscan { match("PORTSCAN " value("MSG")); };


log { source(src); filter(f_myfw); destination(d_myfw); };
log { source(src); filter(f_portscan); rewrite(r_scrubb_ip); destination(d_portscan); };
log { source(src); filter(f_portscan); rewrite(r_truncate); destination(d_portscan); };

#log { source(src); filter(f_messages); destination(messages); };
log { source(src); destination(messages); };
log { source(src); filter(f_messages); destination(console_all); };
--------------------------------------------------------------------------------

The system is a 64 bit hardened Gentoo Linux w/ kernel 3.17.6 and syslog-ng 3.6.1

--
Toralf
pgp key: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 0076 E94E



\
 
 \ /
  Last update: 2014-12-18 16:01    [W:0.031 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site