Greetings list!
I am considering using the conntrack-tools userspace package to perform
byte level accounting for iptables by reading events from the connection
tracking table for completed connections and logging the statistics for
the stateful connection to syslog. It appears that conntrack was really
designed to keep redundant firewalls' state tables in sync, but I'm
intrigued by it's ability to use the new connection tracking and state
notification features in netfilter without having to parse or poll
/proc/net/ip_conntrack.
The goal I'm trying to accomplish is similar to that of:
conntrack -E conntrack -e DESTROY | logger -t conntrack &
which gives me the ability to log completed (e.g. entered the DESTROY
state) connections to syslog from kernel-triggered events. It's plenty
hackish though... it'd be nicer to have an actual daemon that fork()s
and detaches and closes file descriptors and communicates with syslog
directly. I understand that a patch has been contributed to allow
conntrackd to use syslog, but it appears that the logging facility in
conntrackd is limited to recording startup, shutdown, and error
information. In any event, the current incarnation of conntrackd does
not support the long-term recording of event messages.
What would you folks recommend to accomplish this goal? Am I simply
using the wrong tool here, or is it worthwhile to get a-patchin'?
If more appropriate, I'll repost this in netfilter failover, but since
I'm not actually looking to do failover (at the moment) I'd figure I'd
start here.
Thanks in advance for any information or opinions you can provide.
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
