Re: iptables.log
"Peter Czanik (pczanik)" <[email protected]> Sun, 28 Dec 2025 07:11:35 +0000
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <CO1PR19MB512649D1BD6686C606C676DB8BBEA@CO1PR19MB5126.namprd19.prod.outlook.com> |
--===============2482388606248849244==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_CO1PR19MB512649D1BD6686C606C676DB8BBEACO1PR19MB5126namp_"
--_000_CO1PR19MB512649D1BD6686C606C676DB8BBEACO1PR19MB5126namp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Hi,
This filter might be slow down logging of large amount of logs (100k+ EPS),=
but works fine:
filter f_iptables { facility(kern) and message("IN=3D") and message("OUT=
=3D"); };
filter f_messages { not facility(news, mail) and not filter(f_iptables); =
};
This example is from the default openSUSE syslog-ng configuration. You can =
check the whole file at https://build.opensuse.org/projects/home:czanik:sys=
log-ng-githead/packages/syslog-ng/files/syslog-ng.conf.default?expand=3D1
Peter
Peter Czanik (CzP) <[email protected]>
Balabit (a OneIdentity company) / syslog-ng upstream
https://syslog-ng.com/community/
https://twitter.com/PCzanik
________________________________
From: A <[email protected]>
Sent: Sunday, December 28, 2025 07:05
To: [email protected] <[email protected]>
Subject: [syslog-ng]iptables.log
CAUTION: This email originated from outside of the organization. Do not fol=
low guidance, click links, or open attachments unless you recognize the sen=
der and know the content is safe.
How to exclude such lines from logging?
IN=3Dnet0 OUT=3D SRC=3Dxxx.xxx.xxx.xxx DST=3Dxxx.xxx.xxx.xxx LEN=3Dxx TOS=
=3D0xxx PREC=3D0xxx TTL=3Dxx ID=3Dxxxx DF PROTO=3Dxxx SPT=3Dxxxx DPT=3D137 =
WINDOW=3Dxxxxx RES=3D0xxx XXX URGP=3DX
--
___________________________________________________________________________=
___
Member info: %(web_page_url)slistinfo/%(_internal_name)s
Documentation: https://nam12.safelinks.protection.outlook.com/?url=3Dhttp%3=
A%2F%2Fwww.balabit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&d=
ata=3D05%7C02%7Cpeter.czanik%40balabit.com%7Caa00c0b1d33742f8eedb08de45d8d0=
cd%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C639024994695956211%7CUnknow=
n%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiI=
sIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&sdata=3Db1qUjyqwWGwi5uGP=
8VN8Y2vfdRaMkPqPOKN0VIOSgYQ%3D&reserved=3D0<http://www.balabit.com/support/=
documentation/?product=3Dsyslog-ng>
FAQ: https://nam12.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww=
.balabit.com%2Fwiki%2Fsyslog-ng-faq&data=3D05%7C02%7Cpeter.czanik%40balabit=
.com%7Caa00c0b1d33742f8eedb08de45d8d0cd%7C91c369b51c9e439c989c1867ec606603%=
7C0%7C0%7C639024994695980735%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydW=
UsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40=
000%7C%7C%7C&sdata=3DirQf%2BwYy3yLmNOu0aYvoBPjVmZ%2Fp6W7z%2Bhzb6MUfrQc%3D&r=
eserved=3D0<http://www.balabit.com/wiki/syslog-ng-faq>
--_000_CO1PR19MB512649D1BD6686C606C676DB8BBEACO1PR19MB5126namp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
Hi,</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
This filter might be slow down logging of large amount of logs (100k+ EPS),=
but works fine:</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
filter f_iptables { facility(kern) and message("IN=3D") an=
d message("OUT=3D"); };</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
filter f_messages { not facility(news, mail) and not filter(f_iptabl=
es); };<br>
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
This example is from the default openSUSE syslog-ng configuration. You can =
check the whole file at
<a href=3D"https://build.opensuse.org/projects/home:czanik:syslog-ng-githea=
d/packages/syslog-ng/files/syslog-ng.conf.default?expand=3D1">
https://build.opensuse.org/projects/home:czanik:syslog-ng-githead/packages/=
syslog-ng/files/syslog-ng.conf.default?expand=3D1</a></div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
Peter</div>
<div class=3D"elementToProof" id=3D"Signature">
<div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, =
Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=
s=3D"elementToProof">
<br>
</div>
<div class=3D"elementToProof" style=3D"direction: ltr; font-family: Calibri=
, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Peter Czanik (CzP) <[email protected]><br>
Balabit (a OneIdentity company) / syslog-ng upstream<br>
<a target=3D"_blank" href=3D"https://syslog-ng.com/community/">https://sysl=
og-ng.com/<wbr>community/</a><br>
<a target=3D"_blank" href=3D"https://twitter.com/PCzanik">https://twitter.c=
om/PCzanik</a></div>
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">
<br>
</div>
</div>
<div id=3D"appendonsend"></div>
<hr style=3D"display:inline-block;width:98%" tabindex=3D"-1">
<div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st=
yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> A <[email protected]&g=
t;<br>
<b>Sent:</b> Sunday, December 28, 2025 07:05<br>
<b>To:</b> [email protected] <[email protected]><br=
>
<b>Subject:</b> [syslog-ng]iptables.log</font>
<div> </div>
</div>
<div class=3D"BodyFragment"><font size=3D"2"><span style=3D"font-size:11pt;=
">
<div class=3D"PlainText">CAUTION: This email originated from outside of the=
organization. Do not follow guidance, click links, or open attachments unl=
ess you recognize the sender and know the content is safe.<br>
<br>
<br>
How to exclude such lines from logging?<br>
<br>
IN=3Dnet0 OUT=3D SRC=3Dxxx.xxx.xxx.xxx DST=3Dxxx.xxx.xxx.xxx LEN=3Dxx TOS=
=3D0xxx PREC=3D0xxx TTL=3Dxx ID=3Dxxxx DF PROTO=3Dxxx SPT=3Dxxxx DPT=3D137 =
WINDOW=3Dxxxxx RES=3D0xxx XXX URGP=3DX<br>
<br>
--<br>
___________________________________________________________________________=
___<br>
Member info: %(web_page_url)slistinfo/%(_internal_name)s<br>
Documentation: <a href=3D"http://www.balabit.com/support/documentation/?pro=
duct=3Dsyslog-ng">
https://nam12.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.bala=
bit.com%2Fsupport%2Fdocumentation%2F%3Fproduct%3Dsyslog-ng&data=3D05%7C=
02%7Cpeter.czanik%40balabit.com%7Caa00c0b1d33742f8eedb08de45d8d0cd%7C91c369=
b51c9e439c989c1867ec606603%7C0%7C0%7C639024994695956211%7CUnknown%7CTWFpbGZ=
sb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTW=
FpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&sdata=3Db1qUjyqwWGwi5uGP8VN8Y2v=
fdRaMkPqPOKN0VIOSgYQ%3D&reserved=3D0</a><br>
FAQ: <a href=3D"http://www.balabit.com/wiki/syslog-ng-faq">https://nam12.sa=
felinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fwww.balabit.com%2Fwiki%2=
Fsyslog-ng-faq&data=3D05%7C02%7Cpeter.czanik%40balabit.com%7Caa00c0b1d3=
3742f8eedb08de45d8d0cd%7C91c369b51c9e439c989c1867ec606603%7C0%7C0%7C6390249=
94695980735%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDA=
wMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&=
sdata=3DirQf%2BwYy3yLmNOu0aYvoBPjVmZ%2Fp6W7z%2Bhzb6MUfrQc%3D&reserved=
=3D0</a><br>
<br>
</div>
</span></font></div>
</body>
</html>
--_000_CO1PR19MB512649D1BD6686C606C676DB8BBEACO1PR19MB5126namp_--
--===============2482388606248849244==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
______________________________________________________________________________
Member info: %(web_page_url)slistinfo/%(_internal_name)s
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
--===============2482388606248849244==--