Bug 1988837
Summary: | Drop events are logged for all security groups if at least one security group has logging enabled for dropped traffic | ||
---|---|---|---|
Product: | Red Hat OpenStack | Reporter: | Alex Katz <akatz> |
Component: | documentation | Assignee: | James Smith <jamsmith> |
Status: | CLOSED CURRENTRELEASE | QA Contact: | RHOS Documentation Team <rhos-docs> |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | 16.2 (Train) | CC: | apevec, egarciar, froyo, jamsmith, lhh, majopela, mblue, scohen |
Target Milestone: | z3 | Keywords: | Triaged |
Target Release: | 16.2 (Train on RHEL 8.4) | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2023-08-21 15:04:14 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | |||
Bug Blocks: | 1619266 |
Description
Alex Katz
2021-08-01 14:36:15 UTC
As far as I understand the issue happens because there are only two (one for inbound and one for outbound traffic) ACLs created to drop traffic in NBDB: podman exec ovn_controller ovn-nbctl find acl action=drop _uuid : dfd29915-05cd-40bf-a1cb-a4439d604aaa action : drop direction : to-lport external_ids : {} log : true match : "outport == @neutron_pg_drop && ip" meter : acl_log_meter name : neutron-3386a030-5d53-42a4-930d-9bbd793c6590 priority : 1001 severity : info _uuid : 570d5d1a-d43f-4700-aaf5-cb6972bc900d action : drop direction : from-lport external_ids : {} log : true match : "inport == @neutron_pg_drop && ip" meter : acl_log_meter name : neutron-3386a030-5d53-42a4-930d-9bbd793c6590 priority : 1001 severity : info |