linux-kernel - iptables LOG syslog timestamps delayed by about 6 minutes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 18 Dec 2014 15:23:23 +0100
From:	Toralf Förster <toralf.foerster@....de>
To:	Linux Kernel <linux-kernel@...r.kernel.org>,
	syslog-ng@...ts.balabit.hu
Subject: iptables LOG syslog timestamps delayed by about 6 minutes

[@balabit ML: pls Cc: me I'm not subscribed]

It looks a little bit odd to me, that this rule :

$IPT -t filter -A INPUT --match limit --limit 1/second --limit-burst 10 -j LOG --log-prefix "MYFW4 "

logs timestamps which are delayed about 6 minutes wrt to other log messages (for comparisation I made a $>logger "huhu") :

# grep -B 1 -A 1 huhu /var/log/messages
Dec 18 15:04:09 tor-relay kernel: PORTSCAN 80 <scrubbed>
Dec 18 15:10:01 tor-relay tfoerste[15080]: huhu
Dec 18 15:04:09 tor-relay kernel: PORTSCAN 80 <scrubbed>

Yesterday the delay was about 5 minutes - so the delay increases over time. I restarted/reloaded both syslogd and the firewall script few times + activated/deactivated the logging rule. FWIW I do have these rules for syslog defined :


--------------------------------------------------------------------------------
destination d_myfw     { file("/var/log/myfw/ipv4.log"); };
destination d_portscan { file("/mnt/ramdisk/portscan"); };


rewrite r_scrubb_ip {
        subst('\b(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\.(1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])\b',
        "scrubbed", value("MESSAGE"), type("pcre"), flags("global"));
};
rewrite r_truncate {
        subst(' IN=.*', "", value("MESSAGE"), type("pcre"), flags("global"));
};


filter f_myfw     {     match("MYFW4 "           value("MSG")); };
filter f_messages { not match("MYFW4 |PORTSCAN " value("MSG")); };
filter f_portscan {     match("PORTSCAN "        value("MSG")); };


log { source(src); filter(f_myfw); destination(d_myfw); };
log { source(src); filter(f_portscan); rewrite(r_scrubb_ip); destination(d_portscan); };
log { source(src); filter(f_portscan); rewrite(r_truncate); destination(d_portscan); };

#log { source(src); filter(f_messages); destination(messages); };
log { source(src); destination(messages); };
log { source(src); filter(f_messages); destination(console_all); };
--------------------------------------------------------------------------------

The system is a 64 bit hardened Gentoo Linux w/ kernel 3.17.6 and syslog-ng 3.6.1

-- 
Toralf
pgp key: 7B1A 07F4 EC82 0F90 D4C2  8936 872A E508 0076 E94E

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/