This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
Re: monitor changes to iptables
- From: William Cohen <wcohen at redhat dot com>
- To: Daniel Doron <danielmeirdoron at gmail dot com>
- Cc: systemtap at sourceware dot org
- Date: Wed, 11 Oct 2017 10:45:16 -0400
- Subject: Re: monitor changes to iptables
- Authentication-results: sourceware.org; auth=none
- Authentication-results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com
- Authentication-results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=wcohen at redhat dot com
- Dmarc-filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 522F3C059B6A
- References: <CAFwN=+w5JXcD7wT=fyvpM2L=Fc2wdVDBWMH0ef5Tm==oFb_fkw@mail.gmail.com> <0d43b4f5-7f71-c397-fdea-0fbb6e7b36bf@redhat.com> <CAFwN=+xuV5rmGPPjaEgnL2Be5Qmg+MJQb7BW_iehpSrnHwS3SA@mail.gmail.com>
On 10/11/2017 12:47 AM, Daniel Doron wrote:
> Hi William,
> Thanks for the suggestion. Correct me if I am wrong but:
> 1. auditctl does not provide real time / online logging facility
> 2. I would have to parse its logs to the get the info I want
> 3. Does it also use kprobes to get the info? I'll need to strace it to
> see how it works...
>
> I was thinking maybe monitor the ip_tables module directly, but I will
> need to figure out the relevant functions...
Hi Daniel,
The auditctl suggestion was a quick off the top of the head thought about some place that would have that information. There is a timestamp in the audit log information, so if one knowns when the problems occurs it should be possible to identify the events in the audit log happening around that time.
It would be useful to describe what the problem that is being investigated. That background would some context to steer the discussion towards approaches that would best solve the problem.
-Will
>
>
>
> On Tue, Oct 10, 2017 at 11:17 PM, William Cohen <wcohen@redhat.com> wrote:
>> On 10/10/2017 10:49 AM, Daniel Doron wrote:
>>> Hi,
>>>
>>> I am trying to figure out a way to monitor and log changes to iptables
>>> (netfilter). Any ideas would be appreciated...
>>>
>>> Thanks.
>>> Daniel.
>>>
>>
>> Hi Daniel,
>>
>> Would you need to use systemtap for this or would using auditctl as mentioned in the following be sufficient?
>>
>> https://unix.stackexchange.com/questions/206891/audit-on-changes-to-the-running-iptables-configuration
>>
>>
>> -Will