From 53fb5608a8ecb5613a55ec02fd85068ec0f4d49f Mon Sep 17 00:00:00 2001 From: Charles-Henri Date: Thu, 2 Mar 2017 10:58:26 +0100 Subject: [PATCH] Iptables input: document better the ignored rules behavior (#2482) During issue #2215 it was highlighted that the current behavior where rules without a comment are ignored is confusing for several users. This commit improves the documentation and adds a NOTE to the sample config to clarify the behavior for new users. --- CHANGELOG.md | 1 + plugins/inputs/iptables/README.md | 6 +++++- plugins/inputs/iptables/iptables.go | 6 ++++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d8dc382d7..fe5631767 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -74,6 +74,7 @@ be deprecated eventually. - [#2462](https://github.com/influxdata/telegraf/pull/2462): Fix type conflict in windows ping plugin. - [#2178](https://github.com/influxdata/telegraf/issues/2178): logparser: regexp with lookahead. - [#2466](https://github.com/influxdata/telegraf/issues/2466): Telegraf can crash in LoadDirectory on 0600 files. +- [#2215](https://github.com/influxdata/telegraf/issues/2215): Iptables input: document better that rules without a comment are ignored. ## v1.2.1 [2017-02-01] diff --git a/plugins/inputs/iptables/README.md b/plugins/inputs/iptables/README.md index a711f1d4e..2b226b9fe 100644 --- a/plugins/inputs/iptables/README.md +++ b/plugins/inputs/iptables/README.md @@ -2,7 +2,11 @@ The iptables plugin gathers packets and bytes counters for rules within a set of table and chain from the Linux's iptables firewall. -Rules are identified through associated comment. Rules without comment are ignored. +Rules are identified through associated comment. **Rules without comment are ignored**. +Indeed we need a unique ID for the rule and the rule number is not a constant: it may vary when rules are inserted/deleted at start-up or by automatic tools (interactive firewalls, fail2ban, ...). +Also when the rule set is becoming big (hundreds of lines) most people are interested in monitoring only a small part of the rule set. + +Before using this plugin **you must ensure that the rules you want to monitor are named with a unique comment**. Comments are added using the `-m comment --comment "my comment"` iptables options. The iptables command requires CAP_NET_ADMIN and CAP_NET_RAW capabilities. You have several options to grant telegraf to run iptables: diff --git a/plugins/inputs/iptables/iptables.go b/plugins/inputs/iptables/iptables.go index 31b049d9f..eab33bf9f 100644 --- a/plugins/inputs/iptables/iptables.go +++ b/plugins/inputs/iptables/iptables.go @@ -33,14 +33,16 @@ func (ipt *Iptables) SampleConfig() string { ## iptables require root access on most systems. ## Setting 'use_sudo' to true will make use of sudo to run iptables. ## Users must configure sudo to allow telegraf user to run iptables with no password. - ## iptables can be restricted to only list command "iptables -nvL" + ## iptables can be restricted to only list command "iptables -nvL". use_sudo = false ## Setting 'use_lock' to true runs iptables with the "-w" option. ## Adjust your sudo settings appropriately if using this option ("iptables -wnvl") use_lock = false ## defines the table to monitor: table = "filter" - ## defines the chains to monitor: + ## defines the chains to monitor. + ## NOTE: iptables rules without a comment will not be monitored. + ## Read the plugin documentation for more information. chains = [ "INPUT" ] ` }