基于连接跟踪的存储优化日志系统的研究

Linux内核2.4及以上版本中的Netfilter/Iptables防火墙对每个进来的数据包记录一条日志信息,造成信息冗余,耗费大量的日志存储空间。基于Netfilter的连接跟踪功能,以网络连接为相关信息,扩展Netfilter/Iptables的核心数据结构,对同一连接的所有数据包信息进行组织与记录,并动态从内核空间获取日志信息,从而减少日志冗余,方便日志分析与管理。

Research on log system based on connect tracing model for storage optimize

Netfilter/Iptables firewall that embedded in Linux kernel 2.4 or above version recorded one item for each incoming packet in the log function.This would create information redundancy and use a mass of log memory space.This document proposed a method based on connection track function of Netfilter.According to the information of network connection,it recorded one item for all packets information of one connection by expanding the core data structure of the Netfilter/Iptables and it acquired log information from kernel space dynamically.This reduced log redundancy and made log analysis and management convenient.