The ULOG target is used to provide user-space logging of
matching packets. If a packet is matched and the ULOG
target
is set, the packet information is multicasted together with the whole packet
through a netlink socket. One or more user-space processes may then subscribe
to
various multicast groups and receive the packet. This is in other words a more
complete and more sophisticated logging facility that is only used by iptables
and Netfilter so far, and it contains much better facilities for logging
packets. This target enables us to log information to
MySQL databases, and other databases, making it much
simpler to search for specific packets, and to group log entries. You
can find the ULOGD user-land applications at the ULOGD project page.
The --ulog-nlgroup option tells the
ULOG target which netlink group to send the packet to.
There
are 32 netlink groups, which are simply specified as 1-32. If we would like to
reach netlink group 5, we would simply write --ulog-nlgroup
5. The default netlink group used is 1.
The --ulog-prefix option works just the same
as the prefix value for the standard LOG target. This
option
prefixes all log entries with a user-specified log prefix. It can be 32
characters long, and is definitely most useful to distinguish different
log-messages and where they came from.
The --ulog-cprange option tells the
ULOG target how many bytes of the packet to send to the
user-space daemon of ULOG. If we specify 100 as above, we
would copy 100 bytes of the whole packet to user-space, which would include the
whole header hopefully, plus some leading data within the actual packet. If we
specify 0, the whole packet will be copied to user-space, regardless of the
packets size. The default value is 0, so the whole packet will be copied to
user-space.
The --ulog-qthreshold option tells the
ULOG target how many packets to queue inside the kernel
before actually sending the data to user-space. For example, if we set the
threshold to 10 as above, the kernel would first accumulate 10 packets inside
the kernel, and then transmit it outside to the user-space as one single
netlink
multi part message. The default value here is 1 because of backward
compatibility, the user-space daemon did not know how to handle multi-part
messages previously.
