I am running Ubuntu Server, pretty recent, which is set up as a NAT router.
I have an iptables script that runs during boot to set up NAT, port forwarding etc.
I am trying to diagnose an unrelated problem with the box, but /var/log/messages, /var/log/syslog and /var/log/kern.log are all flooded with messages from iptables like this:
Oct 21 11:25:27 skip kernel: [39380.812663] INPUT packet died: IN=eth1 OUT= MAC=00:40:63:d9:7c:5b:00:03:fa:a9:d7:4a:08:00 SRC=24.207.21.237 DST=94.192.123.123 LEN=111 TOS=0x00 PREC=0x00 TTL=54 ID=16494 PROTO=UDP SPT=48865 DPT=20663 LEN=91
I can't find any documentation that makes it clear how to change the way iptables logs output. What I ideally want is for NONE of the iptables stuff to go to any of the above files, but instead to /var/log/iptables.
Best Answer
It's that script. Remove the logging.
If you really want logs (and if you're not reading them then why bother?) then use ULOGD:
http://www.netfilter.org/projects/ulogd/index.html