Project

General

Profile

Actions
Copy link

Feature #16092

open

Separate IDS/IPS and link-local firewall log entries from default block logging

Added by Marcos M about 1 month ago. Updated 5 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Marcos M
Category:
System Logs
Target version:
2.8.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
25.03
Release Notes:
Default

Description

On systems that use Snort/Suricata and also log the default blocking rules, the firewall logs can be very noisy due to snort2c blocks. Add an option to disable the logging for these without having to disable the logging for all other default blocking rules.

The "Block IPv4 link-local" block rule can be similarly noisy.

Files

clipboard-202504191627-wayqt.png (73.9 KB) clipboard-202504191627-wayqt.png Jordan G, 04/19/2025 09:27 PM
Actions
Copy link
 #1

Updated by Marcos M about 1 month ago

  • Status changed from In Progress to Pull Request Review
Actions
Copy link
 #2

Updated by Marcos M about 1 month ago

  • Status changed from Pull Request Review to Feedback
  • % Done changed from 0 to 100
Actions
Copy link
 #3

Updated by Marcos M about 1 month ago

  • Subject changed from Separate snort2c firewall logs from the default blocking logs to Separate snort2c and link-local firewall logs from the default blocking logs
  • Description updated (diff)
Actions
Copy link
 #4

Updated by Jim Pingle 30 days ago

  • Subject changed from Separate snort2c and link-local firewall logs from the default blocking logs to Separate IDS/IPS and link-local firewall log entries from default block logging
Actions
Copy link
 #5

Updated by Jordan G 5 days ago

additional logging preferences are present in 25.03.b.20250414.1838 for specific network subsets and IDS/IPS blocked hosts disabling

Actions
Copy link

Also available in: Atom PDF