On Tuesday 2010-06-01 20:01, Radek Kanovsky wrote: >On Tue, Jun 01, 2010 at 01:56:37PM +0200, Jan Engelhardt wrote: > >> >Changes in /etc ruleset are small but frequent. But primarily both >> >solutions reset couters if used and it is not good for me now. So I >> >ended with script that does incremental updates. >> >> How slow are we talking about? restore is never slower than >> iptables - ever, because, like iptables, it does one table replace >> operation per invocation of either binary. Your "incremental update" >> is in fact none, because tables are always replaced wholesome. > >I take counters snapshot every minute for accounting. I can modify my >system a such way that changes are made immediately after this snapshot >phase via iptables-restore with reseting all counters in time very close >to the last read minimizing outage in accounting. But I can't rely on it >if restore phase takes from 1 seconds to 2 minutes. It would lead to >totally unreliable accounting data and more complicated system. Sounds like you need xt_quota2. As its counters are independent of rules when given names, they can never get set back to a value less than what they were. >why I came with incremental updates that doesn't touch unchanged rules. As I said before, there is no concept of unchanged rules. When you iptables -A, the entire ruleset is fetched from the kernel, then modified, and finally reinserted - even when having only added a single rule. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
