rhel8/9: log limit of firewalld with rich rules not working properly

Solution Unverified - Updated -

Issue

  • We would like to limit logs of firewalld. Therefore, we created a rich rule for firewalld to limit logs to twice a day as the following command on RHEL8.
# firewall-cmd --permanent --zone=XXX \
  --add-rich-rule='rule family="ipv4" source address=198.51.100.131/24 service name=all log prefix="IN_BOUND_XXX " level="info" limit value="2/d" accept'
  • However, more than 2 log entries are generated per day.
  • We can reproduce it on RHEL8.1 to RHEL8.7. On the other hand, we can limit logs by the same command on RHEL7.

Environment

  • Red Hat Enterprise Linux (RHEL) 8 and 9
  • firewalld
    • firewall-cmd
  • nft

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content