Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using Ubuntu 11.04 and my kern.log, bandwidth, and syslog files are filling(And completely consuming my hard drive) with this stuff

Apr 18 20:20:23 main kernel: [1886527.503932] BANDWIDTH_OUT:IN= OUT=eth0 SRC=184.106.76.80 DST=129.42.208.185 LEN=187 TOS=0x00 PREC=0x00 TTL=64 ID=12744 PROTO=TCP SPT=13839 DPT=30051 WINDOW=2003 RES=0x00 ACK PSH URGP=0 
Apr 18 20:20:23 main kernel: [1886527.505102] BANDWIDTH_OUT:IN= OUT=eth0 SRC=184.106.76.80 DST=92.28.250.158 LEN=155 TOS=0x00 PREC=0x00 TTL=64 ID=28110 PROTO=TCP SPT=13743 DPT=13809 WINDOW=65535 RES=0x00 ACK PSH URGP=0 
Apr 18 20:20:23 main kernel: [1886527.505133] BANDWIDTH_OUT:IN= OUT=eth0 SRC=184.106.76.80 DST=78.86.165.146 LEN=155 TOS=0x00 PREC=0x00 TTL=64 ID=64959 PROTO=TCP SPT=13743 DPT=34341 WINDOW=9261 RES=0x00 ACK PSH URGP=0 
Apr 18 20:20:23 main kernel: [1886527.505158] BANDWIDTH_OUT:IN= OUT=eth0 SRC=184.106.76.80 DST=82.9.127.44 LEN=155 TOS=0x00 PREC=0x00 TTL=64 ID=11111 PROTO=TCP SPT=13743 DPT=53016 WINDOW=3593 RES=0x00 ACK PSH URGP=0 
Apr 18 20:20:23 main kernel: [1886527.510378] BANDWIDTH_IN:IN=eth0 OUT= MAC=40:40:1b:3e:06:6a:c8:4c:75:f5:eb:3f:08:00 SRC=86.27.137.140 DST=184.106.76.80 LEN=1300 TOS=0x00 PREC=0x00 TTL=116 ID=9384 DF PROTO=TCP SPT=53925 DPT=13770 WINDOW=258 RES=0x00 ACK URGP=0 
Apr 18 20:20:23 main kernel: [1886527.510425] BANDWIDTH_OUT:IN= OUT=eth0 SRC=184.106.76.80 DST=86.27.137.140 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=6076 PROTO=TCP SPT=13770 DPT=53925 WINDOW=4055 RES=0x00 ACK URGP=0 
Apr 18 20:20:23 main kernel: [1886527.510445] BANDWIDTH_IN:IN=eth0 OUT= MAC=40:40:1b:3e:06:6a:c8:4c:75:f5:eb:3f:08:00 SRC=86.27.137.140 DST=184.106.76.80 LEN=610 TOS=0x00 PREC=0x00 TTL=116 ID=9385 DF PROTO=TCP SPT=53925 DPT=13770 WINDOW=258 RES=0x00 ACK PSH URGP=0 

It seems that the most I can setup log rotation for is daily, and that doesn't seem to be enough, especially if it's backing them up etc. So I'm not looking for a "use log rotation to fix your problem" kind of answer, I'm looking for a way to get rid of these messages. I never had them before, and they are a nuisance.

Thanks.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

you have something that running that logs into syslog, if that logging is not needed, you should either disable it or maybe write into a separate file and rotate that instead.

I think it's Shorewall that does that, so look into there to disable logging Shorewall FAQs

EDIT:

try following howto:

IptablesHowTo - Community Ubuntu Documentation

share|improve this answer
1  
Run the command iptables --list -n -v. I suspect you will see your log source there. After that you simply need to find what is adding the rules. –  Zoredache Apr 18 '12 at 20:45
1  
iptables -L -n -v | grep -i log –  alexus Apr 18 '12 at 20:47
1  
so there you go, you have a rule that logs everything, comment that rule out restart your firewall and you're done! –  alexus Apr 18 '12 at 20:49
1  
try /etc/iptables.rules on CentOS/REDHAT its' in /etc/sysconfig/iptables, try do locate iptables –  alexus Apr 18 '12 at 20:57
1  
thanks that helped. –  kelton52 Apr 18 '12 at 21:02
show 11 more comments

See what you have at /etc/shorewall/start maybe have something pretty similar to this:

run_iptables -I INPUT -i eth0 -j LOG --log-prefix BANDWIDTH_IN: --log-level debug 
run_iptables -I FORWARD -i eth0 -j LOG --log-prefix BANDWIDTH_IN: --log-level debug 
run_iptables -I FORWARD -o eth0 -j LOG --log-prefix BANDWIDTH_OUT: --log-level debug 
run_iptables -I OUTPUT -o eth0 -j LOG --log-prefix BANDWIDTH_OUT: --log-level debug

If so, delete it! If you aren't using Shorewall see your iptables and delete those lines.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.