On Tue, Jun 01, 2010 at 01:56:37PM +0200, Jan Engelhardt wrote: > >Changes in /etc ruleset are small but frequent. But primarily both > >solutions reset couters if used and it is not good for me now. So I > >ended with script that does incremental updates. > > How slow are we talking about? restore is never slower than > iptables - ever, because, like iptables, it does one table replace > operation per invocation of either binary. Your "incremental update" > is in fact none, because tables are always replaced wholesome. I take counters snapshot every minute for accounting. I can modify my system a such way that changes are made immediately after this snapshot phase via iptables-restore with reseting all counters in time very close to the last read minimizing outage in accounting. But I can't rely on it if restore phase takes from 1 seconds to 2 minutes. It would lead to totally unreliable accounting data and more complicated system. Thats why I came with incremental updates that doesn't touch unchanged rules. Regards Radek Kanovsky -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
