rhel8/9: log limit of firewalld with rich rules not working properly
Issue
- We would like to limit logs of firewalld. Therefore, we created a rich rule for firewalld to limit logs to twice a day as the following command on RHEL8.
# firewall-cmd --permanent --zone=XXX \
--add-rich-rule='rule family="ipv4" source address=198.51.100.131/24 service name=all log prefix="IN_BOUND_XXX " level="info" limit value="2/d" accept'
- However, more than 2 log entries are generated per day.
- We can reproduce it on RHEL8.1 to RHEL8.7. On the other hand, we can limit logs by the same command on RHEL7.
Environment
- Red Hat Enterprise Linux (RHEL) 8 and 9
- firewalld
- firewall-cmd
- nft
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.