Re: Auditing network traffic

Sorry, I probably was not clear here. I am able to catch packets by adding iptables rules like ones you've mentioned and process events (with record type AUDIT_NETFILTER_PKT) by code inside my plugin. The problem is, I would prefer them not to be written to logfiles. My business logic does not require that (everything is handled by plugin code), and I noticed that logs are rotated quite fast (I capture all incoming/outgoing packets). So, is there any way to disable logging and make audit deliver those events to plugin only?