Nfacct drop patterns
From Initech Technical Wiki
Revision as of 21:16, 18 October 2019 by Timprice (talk | contribs) (Created page with "This file is used by /usr/local/bin/nfacct-clickhouse-import to pre-filter /tmp/nfacct.json before being imported into clickhouse. It should contain a list of PCRE re...")
This file is used by /usr/local/bin/nfacct-clickhouse-import to pre-filter /tmp/nfacct.json before being imported into clickhouse. It should contain a list of PCRE regex patterns which grep uses to reverse-match. Example below.
"port_dst": 123,.*"ip_proto": "udp", "port_src": 123,.*"ip_proto": "udp", "ip_proto": "icmp", "port_dst": 53,.*"ip_proto": "udp", "port_src": 53,.*"ip_proto": "udp",