Hi, I am using GuardDog to configure my Firewall. It is easy to use and seems to work well. However it is generating huge log files. eg.:-

Jan 28 09:31:21 linux kernel: ABORTED IN=eth1 OUT= MAC=00:40:f4:5e:f9:d8:00:40:f4:5e:f3:87:08:00 SRC=10.0.0.40 DST=10.0.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=128 ID=39434 DF PROTO=TCP SPT=1084 DPT=3128 WINDOW=0 RES=0x00 RST URGP=0
Jan 28 09:31:21 linux kernel: ABORTED IN=eth1 OUT= MAC=00:40:f4:5e:f9:d8:00:40:f4:5e:f3:87:08:00 SRC=10.0.0.40 DST=10.0.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=128 ID=39690 DF PROTO=TCP SPT=1085 DPT=3128 WINDOW=0 RES=0x00 RST URGP=0

There is voulmes of this stuff and to be quite honest I do not know what any of it means. I have all the log options turned off in GuardDog but to no avail.

Any ideas out there?

Regards,
Sean

This is not from Guarddog specifically but probably a part of /var/log /messages from syslog I believe. The various fields show various hits on the firewall. SRC is the source address, DST is the destination address, PROTO is the protocol used (either UDP or TCP ususally). Lots of these are just routine traffic, you can tell what is from outside the firewall versus inside the firewall by the SRC addresses. There is a function called logrotate which you can configure and you can also just periodically empty the logs manually yourself.

Good Luck
Alan