Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In my iptables log, I get very repetitive and hard to read data like that:

MAC, IN, LEN, TOS, PREC, TTL, ID, WINDOW, RES, URGP

I am using my Ubuntu machine as a web server. Which one of these can I eliminate of my iptables log? Which ones are useful for security and monitoring?

How can I disable that unnecessary data?

share|improve this question
    
All of them may be useful, depending on what you need to know. I any case you should probably looking at ULOG tools so you do your logging/filtering through a user-space process. –  Zoredache Sep 24 '12 at 21:39
    
BTW, given your other question from earlier, I am tempted to suggest you simply disable logging. It sounds to me like you are trying to collect data you don't know how to use, and probably don't need. –  Zoredache Sep 24 '12 at 21:44
    
Hi, I am just trying to know when a certain IP is looking for ports to get inside my web server. I am not using this machine as anything else than a web server –  anthony01 Sep 24 '12 at 21:50
    
And what do you plan on doing once you find that something is probing your system? If you are on the Internet you are going to be scanned, and if you log everything, you are going to have a huge log file with information you can't do a anything about. –  Zoredache Sep 24 '12 at 22:07
    
Hi thanks for your suggestion. I'm trying to look at ULOG tools and netfilter seems to be an option. If there is anything more appropriate, feel free to let me know. Thanks a lot –  anthony01 Sep 25 '12 at 17:11
add comment

1 Answer

up vote 1 down vote accepted

You could always use Perl to extract the information you're interested in from the logs, e.g.:

perl -ne 'print "$1 $2 $3\n" if /(SRC=\S+).*(DST=\S+).*(DPT=\S+)/'

As others have already said it's not advisable to omit fields from the logs, because you may need that information at some point.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.