Log firewall rules but dont store locally
-
Im looking to log all my firewall rules BUT to send them to a remote server and not have them written to disk locally.
Today I have all my traffic rules set to log and while they are stored locally they are also sent to Splunk for ingest. Is there a way to have them logged , sent to splunk but not saved locally? -
No, not for firewall logs like that. At least no way I'm aware of.
-
@stephenw10 this is for an 1100. Just super concerned about the writes to the disk if I log my rules. Your expert opinion…should i
Be worried over that eMMC? -
Depends how busy the firewall is but if you're logging every new connection that could be a lot of logs.
I would use a ram disk /var and export logs at the same time. Leaving the local logs at the default size won't be an issue if they are also exported.
-
@stephenw10 this is now a remote install. Can I convert to RAM disks via the GUI, probably restart the unit and have it come back up without issue ?
-
I would certainly expect to. I've never had any issues enabling RAM disks. Just make sure the size you set for /var is at least larger than it's currently using.
There are some packages that won't work with RAM disks or at least not without significant tuning. Snort or Suricata primarily.
