Tagged Questions
0
votes
1answer
43 views
Parse Apache logfile and ban IPs
My server is under attack, it is flooded with request with the following pattern:
Thousands of IPs
Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
1
vote
0answers
99 views
iptables log nowhere to be found
I'm trying to log when IPTables drops connections mostly for analysis. Problem is, my log seems to be written to... nowhere.
By this time I know that iptables logs through kern facility and for this, ...
0
votes
1answer
80 views
IP logging on a Linux access point [closed]
Here I'm using my RaspberryPi as a WLAN router. It is connected to my LAN by wire (which leads to my DSL router), additionally it is equipped with a USB WLAN stick. I'm using hostapd for providing the ...
-6
votes
2answers
81 views
Someone is using a lot of bandwith through OpenVPN, how can I find out who?
I just checked bandwith usage on SolusVM and it was 250gb in 2 days, and I know it's one of my users through OpenVPN.
I think it is a torrent because it is upload + download 24/7.
I want to find out ...
1
vote
0answers
237 views
iptables: how to decide what to log for a web server?
There are many ways to log traffic for a web server. For example, if I want to log all incoming traffic, I can place the following line as the first rule appended to the INPUT chain:
-A INPUT -j LOG ...
1
vote
1answer
108 views
Understanding log messages from iptables
I have enabled logging with iptables. Now, I need to understand some of the abbreviations.
Feb 23 20:43:08 spiderman kernel [ 2905.992450]: IN=wlan0 OUT=
...
1
vote
1answer
73 views
Unable to log iptables
I'm having trouble getting iptables to log to any file.
My iptables looks like:
Chain INPUT (policy ACCEPT 1366 packets, 433582 bytes)
pkts bytes target prot opt in out source ...
3
votes
3answers
351 views
iptables: How to read this OPT string?
I have a simple INPUT rule for iptables that logs any new connections to a logfile.
--log-tcp-options and --log-ip-options flags are both set and I get the appropriate OPT output.
One line of my log ...
0
votes
1answer
56 views
Centos log stream for iptables failed
I am trying to block all connections to my pop3, imap server excepting my ip address and log dropped connections to a logfile
/etc/sysconfig/iptables
...
-N accept-n-log
-A accept-n-log -j LOG ...
0
votes
1answer
364 views
Rotating Iptables logs with logrotate
I'm running CentOS6 and I configured rsyslog to monitor my iptables warning messages and dump them in /var/log/iptables.log. I went through my logrotate.d/syslog file and added iptables.log so ...
0
votes
1answer
166 views
Kernel Logging disabled?
uname -a
Linux host 2.6.32-279.9.1.el6.i686 #1 SMP Tue Sep 25 20:26:47 UTC 2012 i686 i686 i386 GNU/Linux
And start ups:
ls /etc/init.d/
abrt-ccpp certmonger dovecot irqbalance ...
2
votes
0answers
107 views
a good tool to analyse iptables log? [closed]
I have some linux server with iptables and I'm looking for an offline tool that allow log analysis to detect suspicious activity .
I dont think that installing a web tool is a good choice beacause ...
0
votes
0answers
59 views
how to log all forward ip address
I am running vpn servers, but some customers using vpn sending spams
so I want to log all ip forward information into a log file
eg: x.x.x.x(public IP)--->forward 10.0.0.x(vpn privated IP)
if ...
2
votes
2answers
745 views
How to Enable IPtables TRACE Target on Debian Squeeze (6)
I am trying to use the TRACE target of IPtables but I can't seem to get any trace information logged. I want to use what is described here:
Debugger for Iptables.
From the iptables man for TRACE:
...
0
votes
1answer
345 views
Iptables doesn't log to /var/log/kern.log or syslog
iptables -A FORWARD -p tcp -j LOG --log-level debug
or
iptables -A FORWARD -p tcp -j LOG --log-level info
or
iptables -A INPUT -p tcp -j LOG --log-prefix ' INPUT TCP ' --log-level 7
Doesn't log ...
0
votes
2answers
285 views
iptables log parser
I want a program who feed iptables log and print it in readable form.
This bugs me out:
Apr 23 19:36:27 ******* kernel: [ 8195.237958] iptables DROP: IN= OUT=wlan0 SRC=192.168.1.102 ...
1
vote
1answer
62 views
Iptables: how do I LOG what's not being ACCEPTED and limit what gets logged?
How do I log what's not being accepted by the following rule:
iptables -A OUTPUT -p icmp --icmp-type 3 -m -limit --limit 10/minute -j ACCEPT
And how do I limit what's being logged because I don't ...
0
votes
1answer
170 views
iptables doesn't want to log and drop simultaneously
I'm (still) trying to build an iptables firewall, but this time, I'm stuck trying to log dropped packets. Here is how I'm doing this (this code is inserted after the ACCEPT rules; $IPT represents the ...
0
votes
1answer
166 views
Logging websites with iptables
I currently have a Sokeris net4501 running Voyage Linux acting as a firewall using iptables. Is it possible to use iptables to log all websites that are visited? If not, is there any other software ...
2
votes
1answer
430 views
CentOS and iptables Logging
I am working with some CentOS rules and would like to be able to log the dropped items from iptables out to a separate file. What is the best way to setup CentOS to log dropped iptables matches to a ...
0
votes
1answer
160 views
Set alternate log file for iptables with syslog-ng
Does anyone know how to set an alternate logging file for iptables with syslog-ng on Ubuntu Server?
0
votes
1answer
201 views
iptables logging packets coming from the outside world
I want to log all INPUT packets that do not originate in the LAN for audit purposes, I have a script with tcpdump basically appending to a file the result from this:
tcpdump "(dst net 192.168.0.0/24 ...
2
votes
5answers
250 views
Linux Traffic Logging
I'm looking for a good free method of logging IP heading information (src/dest IP with timestamp) passing through a Linux router.
I know I can do this with
tcpdump -i eth0 > log.txt
However I'm ...
1
vote
1answer
453 views
How to interpret “port scans” from log
We use CSF on our server, and it automatically blocks IPs if it detects a port scan. This is the report we get when such an event occurs:
Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN ...
1
vote
2answers
281 views
How do I know what connections has my debian server blocked?
In short, I am actually looking for the log files to see any incoming connection being blocked in debian lenny server.
Or any other way to know? I am using iptables
4
votes
1answer
4k views
How can I log iptables in Ubuntu just in /var/log/firewall with rsyslogd
I am using ubuntu 10.10. with iptables! I want to log my firewall drops in the file /var/log/firewall and NOT in any other logfile.
So I added the following line to my file: ...
0
votes
5answers
2k views
iptables logging not working?
OS: Ubuntu 10.04
Logging daemon: rsyslog
For some reason i'm not getting any iptables logs, even thought i don't look through them very often i'd still like to get it working for the sake of it ...
4
votes
4answers
2k views
Log every IP connecting on a system with iptables
Title says it all.
How can I, with iptables under Linux, log all IP connecting to a server?
As a little detail, I'd like to have only ONE entry in the log PER DAY PER IP.
Thanks :)
EDIT:
I ...
