graylog-deploy/rules/rule15_conntrack_table_full.json

5 lines
503 B
JSON

{
"title": "conntrack_table_full",
"description": "Linux kernel: nf_conntrack table full, dropping packets - active packet loss on this NAT/firewall host (standard, well-documented kernel message)",
"source": "rule \"conntrack_table_full\"\nwhen\n contains(to_string($message.message), \"nf_conntrack: table full, dropping packet\")\nthen\n set_field(\"vendor\", \"linux-conntrack\");\n set_field(\"event_type\", \"conntrack_table_full\");\n set_field(\"severity_tag\", \"critical\");\nend"
}