<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:b1b30ee4@opayq.com" title="Netbug <b1b30ee4@opayq.com>"> <span class="fn">Netbug</span></a>
</span> changed
<a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - ulogd_inppkt_NFLOG.c:503 forcing unbind of existing log handler for protocol"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=977">bug 977</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>RESOLVED
</td>
<td>REOPENED
</td>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>INVALID
</td>
<td>---
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - ulogd_inppkt_NFLOG.c:503 forcing unbind of existing log handler for protocol"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=977#c27">Comment # 27</a>
on <a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - ulogd_inppkt_NFLOG.c:503 forcing unbind of existing log handler for protocol"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=977">bug 977</a>
from <span class="vcard"><a class="email" href="mailto:b1b30ee4@opayq.com" title="Netbug <b1b30ee4@opayq.com>"> <span class="fn">Netbug</span></a>
</span></b>
<pre>Hi Eric,
The logging was my mistake, I truly apologize...
I read this regarding NFLOG and the group;
```````````````````````
Shorewall
4) Support for the NFLOG log target has been added. NFLOG is a
successor to ULOG. In addition, both ULOG and NFLOG may be followed
by a list of up to three numbers in parentheses.
The first number specifies the netlink group (1-32). If omitted
(e.g., NFLOG(,0,10)) then a value of 1 is assumed.
The second number specifies the maximum number of bytes to copy. If
omitted, 0 (no limit) is assumed.
The third number specifies the number of log messages that should
be buffered in the kernel before they are sent to user space. The
default is 1.
Examples:
/etc/shorewall/shorewall.conf:
MACLIST_LOG_LEVEL=NFLOG(1,0,1)
So I now added in to my shorewall NFLOG(1,0,1), which if I'm understanding this
correct, the first 1 gives me group 1 which I believe is what you said I need.
And now with this setting I'm seeing logging... :)
In ulog.conf I'm using;
stack=log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,print1:PRINTPKT,emu1:LOGEMU
But I noticed I was still getting these messages;
ulogd_inppkt_NFLOG.c:503 forcing unbind of existing log handler for protocol 2
ulogd_inppkt_NFLOG.c:503 forcing unbind of existing log handler for protocol 7
ulogd_inppkt_NFLOG.c:503 forcing unbind of existing log handler for protocol 10
And I noticed that if I commentd out #bind=1 under [log2] then these messages
don't appear;
```````````````````````
[log2]
# netlink multicast group (the same as the iptables --nflog-group param)
group=1 # Group has to be different from the one use in log1
#netlink_socket_buffer_size=217088
#netlink_socket_buffer_maxsize=1085440
# If your kernel is older than 2.6.29 and if a NFLOG input plugin with
# group 0 is not used by any stack, you need to have at least one NFLOG
# input plugin with bind set to 1. If you don't do that you may not
# receive any message from the kernel.
#bind=1
```````````````````````
Then now with the #bind=1 commented the ulog.log is clean; /var/log/ulogd.log;
and as I mentioned, I'm still getting logging to work...
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `NFLOG'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `NFCT'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `IFINDEX'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `IP2STR'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `IP2BIN'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `PRINTPKT'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `HWHDR'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `PRINTFLOW'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `LOGEMU'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `SYSLOG'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `XML'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `GPRINT'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `BASE'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `NFACCT'
Fri Nov 21 16:45:42 2014 <5> ulogd.c:375 registering plugin `GRAPHITE'
So I thought you mentioned I need to have bind=1 uncommented? But it creates
these messags, so maybe there's still something going on here, and not a user
error at this point?</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>