monitor changes to iptables

[Daniel Doron]

Hi William,
Thanks for the suggestion. Correct me if I am wrong but:
1. auditctl does not provide real time / online logging facility
2. I would have to parse its logs to the get the info I want
3. Does it also use kprobes to get the info? I'll need to strace it to
see how it works...

I was thinking maybe monitor the ip_tables module directly, but I will
need to figure out the relevant functions...



On Tue, Oct 10, 2017 at 11:17 PM, William Cohen <wcohen@redhat.com> wrote:
> On 10/10/2017 10:49 AM, Daniel Doron wrote:
>> Hi,
>>
>> I am trying to figure out a way to monitor and log changes to iptables
>> (netfilter). Any ideas would be appreciated...
>>
>> Thanks.
>> Daniel.
>>
>
> Hi Daniel,
>
> Would you need to use systemtap for this or would using auditctl as mentioned in the following be sufficient?
>
> https://unix.stackexchange.com/questions/206891/audit-on-changes-to-the-running-iptables-configuration
>
>
> -Will