Westermo RedFox Series - Manual (Page 707)

Westermo OS Management Guide
Version 4.17.0-0
This makes a rate of “1 per second” to be exactly the same as “60 per minute”
and “3600 per hour” (also “86400 per day”, but that can not be configured as
the biggest permitted value for any unit is 10000)
It is not possible to set non-continous rates like: 100 entries per calendar day
etc.
If the rate limit of log entries is reached, the logging system will instantly begin
throwing away excessive log entries. The logging will not be buffered or
delivered later to the log file.
The rate limitation can be disabled through configuration, but this will open up
for potential problems with malicious attacks or storms, therefore it is not rec-
ommended that you disable the limitation mechanism. But you can and
should adjust the limit to fit your needs.
Firewall logging can also be disabled on a system level. Nothing will be logged
even if there is logging configured for individual firewall rules.
The default rate limitation will be set to “5 per second” when the firewall is en-
abled through the web or CLI.
31.1.6.3 Firewall log format
WeOS uses the Linux Netfilter logging mechanism. The standard Netfilter log
format is used for recorded entries.
Log entries will be prefixed with the type of rule that was hit, and will always be
one of: FW-ALLOW, FW-DENY, FW-NAPT, FW-1TO1 or FW-PF (port forwarding).
Remember that the kernel log is shared with other types of logging. The prefixes
are a good way to find the relevant log entries in the file.
You will not see exactly which firewall rule that triggered a log entry, only the type
of it. This can be a problem if you use many rules with logging enabled. However,
the information provided in the log should be enough to figure out what specific
rule was causing it.
A rule position number or some other helping reference to the specific rule may
be added in a later release of WeOS.
➞ 2015 Westermo Teleindustri AB 707