I log all dropped packets using following iptables rule:
-A INPUT -j LOG --log-prefix "FW_DROP: " --log-level 7
and then in rsyslog.conf, I redirect this output to a separate file, so that my syslog is not flooded
:msg, contains, "FW_DROP" -/var/log/firewall.log & ~
This works for syslog, but my dmesg still gets flooded with the fw messages, which drives me crazy. Would anybody know how to prevent this?