Re: iptables log target logs everything to tty*. Why?

[Erik Persson <erik-maillist@djingis.se>]

Wayne Topa wrote:
> Erik Persson(erik-maillist@djingis.se) is reported to have said:
> > Hey!
> >
> > I'm running a debian sarge as a router for a network, and I'm using 
> > iptables. I need to log certain stuff from iptables, and I thus have 
> > rules like:
> > ${PROG} -A FORWARD -i eth1 -o eth0 -p tcp --dport 135 -m limit
> >  --limit 1/s -j LOG --log-prefix "Blaster portscan "
> >
> > This however has the not so desirable side effect of writing every log 
> > message from iptables to all tty:s as well as to /var/log/messages. And 
> > I can tell you it is very annoying!
> >
> > First I just thought it had something to do with syslogd and checked 
> > syslogd.conf. I could not find any rule that would generate this 
> > behavior, but to be on the safe side I stopped syslogd.
> > The messages kept on coming.
> >
> > Then I thought it might be klogd and I killed it off as well. The 
> > messages kept on coming on the ttys. Then I tried klogd -c 0 whithout 
> > any luck.
> >
> > Does anyone know how to get rid of this other than just removing the log 
> > rules from iptables?
>
> Does /etc/init.d/klogd have this line
>
> KLOGD="-c 4" 
>
> if yes then I don't know.
>
> Wayne

I tried with klogd -c 0 but the messages just kept on coming. It seems 
that the minimal allowed log level for kernel messages was set to 4 on 
the router and klogd -c 0 thus didn't change the kernel log level as I 
thought. This solves the problem since I now know what caused it. I will 
probably change the iptables log level to debug to get rid of the messages.

/ep