2

I noticed that there are data in the iptables log that I don't need, so I was wondering if it's possible to change some configuration so that the log has less information, thus reducing the log's size.

I would like log a write only once per IP during some times.

Anthon
  • 78,313
  • 42
  • 165
  • 222
antoine
  • 21
  • 1

1 Answers1

1

You can use the hashlimit match. Take a look on the options here.
In order to log once per source ip per hour, you would have, for example :

iptables -A INPUT -m hashlimit --hashlimit-upto 1/hour --hashlimit-mode srcip -j LOG

Basing on your needs, you can use the following modes : srcip, dstip, srcport, dstport and the following length : /sec, /minute, /hour, /day.

setenforce 1
  • 482
  • 2
  • 6