>> hen there will be nothing logged. Try generating some traffic that will
>> trigger one of those rules.
>>
> that's the thing, i have 5 users connected to that lab environment
> generating good amount of traffic.
> that's exactly my problem, that even though there are traffic generated,
> it's not being inserted into mysql
>
I might be wrong here, but if you are using ulogd 2.x, then the correct
target to deploy is NFLOG, not ULOG. To test whether you get any logs
into your database conduct this (fairly) simple test:
iptables -I INPUT 1 -j NFLOG --nflog-group X --nflog-range Y
--nflog-threshold Z --nflog-prefix "TEST:TEST"
iptables -I OUTPUT 1 -j NFLOG --nflog-group X --nflog-range Y
--nflog-threshold Z --nflog-prefix "TEST:TEST"
iptables -I FORWARD 1 -j NFLOG --nflog-group X --nflog-range Y
--nflog-threshold Z --nflog-prefix "TEST:TEST"
where 'X' is the group number assigned to your ulogd stack (in other
words, 'group=X' from ulogd.conf), 'Y' is the ulogd range (usually 0)
and 'Z' is the ulogd threshold (usually 1).
Then generate some traffic and see whether you get any matches with
'iptables -L -vn'. If so, then check your mysql database to see whether
packets have been logged - if that is indeed the case, delete the above
3 rules ('iptables -D INPUT 1' and so on). If not, post your ulogd.conf
here, though as Tom already suggested, you are better off seeking help
on the netfilter mailing list.
------------------------------------------------------------------------------
Own the Future-Intel® Level Up Game Demo Contest 2013
Rise to greatness in Intel's independent game demo contest.
Compete for recognition, cash, and the chance to get your game
on Steam. $5K grand prize plus 10 genre and skill prizes.
Submit your demo by 6/6/13. http://p.sf.net/sfu/intel_levelupd2d
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
