OpenVZ Forum


Home » General » Support » iptables LOG target in VE :: supported?
iptables LOG target in VE :: supported? [message #15906] Wed, 15 August 2007 17:41 Go to next message
rickb is currently offline  rickb
Messages: 368
Registered: October 2006
Senior Member
Hello friends.

I am attempting to use the iptables log target in the VE.

[root@arsenic ~]# lsmod | grep -i log
ipt_LOG                 7712  56 
ip_tables              23472  16 ipt_recent,ipt_REDIRECT,iptable_nat,ipt_state,ipt_length,ipt_ttl,ipt_tcpmss,ipt_TCPMSS,iptable_mangle,iptable_filter,ipt_multiport,ipt_limit,ipt_LOG,ipt_TOS,ipt_tos,ipt_REJECT
[root@arsenic ~]# 

[root@arsenic ~]# vzctl enter 9890933
entered into VE 9890933
[root@dark /]#

[root@dark /]# grep LOG /proc/net/ip_tables_targets
LOG


When I create a simple logging rule such as: '-A INPUT -p tcp --dport 22 -j LOG', no messages seem to be hitting syslog. I tested this with a Centos4 VE.

Am I missing something here or is the log target unsupported in the VE context? If so, I will create a bugzilla report.

Thank you
Rick


-------------
Common Terms I post with: http://wiki.openvz.org/Category:Definitions

UBC. Learn it, love it, live it: http://wiki.openvz.org/Proc/user_beancounters
Re: iptables LOG target in VE :: supported? [message #15908 is a reply to message #15906] Wed, 15 August 2007 18:45 Go to previous messageGo to next message
sspt is currently offline  sspt
Messages: 100
Registered: August 2006
Location: Portugal
Senior Member
I've also noticed the same behaviour with CentOS 5 (Host) + CentOS 5 (VE).

http://static.openvz.org/userbars/openvz-user.png
Re: iptables LOG target in VE :: supported? [message #15930 is a reply to message #15908] Thu, 16 August 2007 07:26 Go to previous messageGo to next message
khorenko is currently offline  khorenko
Messages: 533
Registered: January 2006
Location: Moscow, Russia
Senior Member
1) does 'dmesg' shows the logs from ipt_LOG?
2) is klogd runnig inside a VE? (by default it's not)

i guess this (2) is the reason. Could you please check?

Thank you,
Konstantin.


If your problem is solved - please, report it!
It's even more important than reporting the problem itself...
Re: iptables LOG target in VE :: supported? [message #20152 is a reply to message #15930] Wed, 12 September 2007 15:26 Go to previous messageGo to next message
ugob is currently offline  ugob
Messages: 271
Registered: March 2007
Senior Member
How do you get klogd to run? It is not started by syslog's init script.

Please read the manual before asking questions:
http://download.openvz.org/doc/OpenVZ-Users-Guide.pdf

Please have a look at the wiki before asking questions:
http://wiki.openvz.org/Main_Page
Re: iptables LOG target in VE :: supported? [message #20226 is a reply to message #20152] Thu, 13 September 2007 14:21 Go to previous messageGo to next message
khorenko is currently offline  khorenko
Messages: 533
Registered: January 2006
Location: Moscow, Russia
Senior Member
Well, we do change syslog in template's post-install scripts to skip klogd startup, but you can undo the changes - just diff syslog init script from a VE and from the normal system.

The idea is "passed klogd skipped $KLOGD_OPTIONS" -> "daemon klogd $KLOGD_OPTIONS", the same for stopping and might be some other pieces of code dealing with klogd in /etc/rc.d/init.d/syslog.


If your problem is solved - please, report it!
It's even more important than reporting the problem itself...
Re: iptables LOG target in VE :: supported? [message #20228 is a reply to message #20226] Thu, 13 September 2007 15:10 Go to previous messageGo to next message
ugob is currently offline  ugob
Messages: 271
Registered: March 2007
Senior Member
I understand. What is the goal of not starting klogd in the VEs?

Please read the manual before asking questions:
http://download.openvz.org/doc/OpenVZ-Users-Guide.pdf

Please have a look at the wiki before asking questions:
http://wiki.openvz.org/Main_Page
Re: iptables LOG target in VE :: supported? [message #20269 is a reply to message #20228] Fri, 14 September 2007 13:04 Go to previous messageGo to next message
khorenko is currently offline  khorenko
Messages: 533
Registered: January 2006
Location: Moscow, Russia
Senior Member
At the very beginning kernel log simply was not virtualized.
So this was just a redundant process inside a VE.
Time changes but nobody asked about it so it was left as is.
One more reason: klogd calls sync() quite often and on a heavy loaded nodes this might be a long operation cause it affects all VEs on the node.


If your problem is solved - please, report it!
It's even more important than reporting the problem itself...
Re: iptables LOG target in VE :: supported? [message #20273 is a reply to message #20269] Fri, 14 September 2007 13:22 Go to previous messageGo to next message
ugob is currently offline  ugob
Messages: 271
Registered: March 2007
Senior Member
Ok

I think this should be documented somewhere... What do you think?

I can help if needed.


Please read the manual before asking questions:
http://download.openvz.org/doc/OpenVZ-Users-Guide.pdf

Please have a look at the wiki before asking questions:
http://wiki.openvz.org/Main_Page
Re: iptables LOG target in VE :: supported? [message #20275 is a reply to message #20226] Fri, 14 September 2007 13:29 Go to previous messageGo to next message
ugob is currently offline  ugob
Messages: 271
Registered: March 2007
Senior Member
I guess I would have to change the stop() as well? Otherwise klogd is not killed at stop.

Please read the manual before asking questions:
http://download.openvz.org/doc/OpenVZ-Users-Guide.pdf

Please have a look at the wiki before asking questions:
http://wiki.openvz.org/Main_Page
Re: iptables LOG target in VE :: supported? [message #20276 is a reply to message #20275] Fri, 14 September 2007 13:57 Go to previous messageGo to next message
khorenko is currently offline  khorenko
Messages: 533
Registered: January 2006
Location: Moscow, Russia
Senior Member
finist wrote on Thu, 13 September 2007 18:21

The idea is "passed klogd skipped $KLOGD_OPTIONS" -> "daemon klogd $KLOGD_OPTIONS", the same for stopping and might be some other pieces...

ugob wrote on Fri, 14 September 2007 17:29

I guess I would have to change the stop() as well? Otherwise klogd is not killed at stop.

Yes, you are right.

ugob wrote on Fri, 14 September 2007 17:22

Ok
I think this should be documented somewhere... What do you think?
I can help if needed.

Well, agree, it makes sense to document it. i suppose a wiki page devoted to klogd would be perfect and it would be great if you can help us creating it. So if you have time, you are welcome.


If your problem is solved - please, report it!
It's even more important than reporting the problem itself...
Re: iptables LOG target in VE :: supported? [message #20287 is a reply to message #20276] Fri, 14 September 2007 16:29 Go to previous messageGo to next message
ugob is currently offline  ugob
Messages: 271
Registered: March 2007
Senior Member
Yes, I would take the time. How should we proceed?

Ugo


Please read the manual before asking questions:
http://download.openvz.org/doc/OpenVZ-Users-Guide.pdf

Please have a look at the wiki before asking questions:
http://wiki.openvz.org/Main_Page
Re: iptables LOG target in VE :: supported? [message #20355 is a reply to message #20287] Mon, 17 September 2007 08:48 Go to previous message
khorenko is currently offline  khorenko
Messages: 533
Registered: January 2006
Location: Moscow, Russia
Senior Member
Answered via PM.

If your problem is solved - please, report it!
It's even more important than reporting the problem itself...
Previous Topic: Trouble compiling kernel
Next Topic: Audit issues
Goto Forum:
  


Current Time: Tue Dec 05 09:09:39 GMT 2023

Total time taken to generate the page: 0.02291 seconds