0

I have a slightly elaborate firewall setup where my server usually has between 400 and 800 ip addresses firewalled. It switches back and forth between two different pf tables. Every day it rebuilds the firewall list in the new table and flushes the old one. It does this all via script and it works very well.

But the problem is this ALTQ error. Every time you use pfctl for anything, the first thing it does is output two error lines:

No ALTQ support in kernel
ALTQ related functions disabled

Problem is my script runs pfctl hundreds of times per day. The error log for my script is growing WAY too fast.

Is there any way to suppress these error messages? pfctl does have a -q flag but that's only for ignoring non-error output. Is there a way I can more fully disable ALTQ in the config file so it won't even try to use it?

Note that I don't know what ALTQ is, but I know I don't need it. My firewall works perfectly aside from the log flood.

  • I gotta ask, why are you running pfctl hundreds of times per day? – Allan May 7 at 21:16
  • @Allan I keep my master list of bad hosts in sql. Every day at 3am or so, my server rebuilds that list into a new pf table, then empties the old table. This is how old bans expire. Depending on how much bad traffic there's been lately, the number of blocked hosts can be large. – l008com May 7 at 21:31
2
+100

I am probably missing something, because this does not seem to be a complex question. If you what to screen out these 2 error messages, then enter the command given below.

pfctl >2 >(grep -v -e "No ALTQ support in kernel" -e "ALTQ related functions disabled" 1>&2)

I omitted any parameters that would normally occur between pfctl and >2. A function could be defined which would simplify the use of this command. One such function implementation is shown below.

pfctl() {
    command pfctl "$@" >2 >(grep -v -e "No ALTQ support in kernel" -e "ALTQ related functions disabled" 1>&2)
}

Under certain conditions, the above solution could result in the output appearing "out of order". This could be corrected by piping the output through the cat command. In other words, you could use the command given below.

pfctl >2 >(grep -v -e "No ALTQ support in kernel" -e "ALTQ related functions disabled" 1>&2) | cat

Also the function could be replaced with the one given below.

pfctl() {
    command pfctl "$@" >2 >(grep -v -e "No ALTQ support in kernel" -e "ALTQ related functions disabled" 1>&2) | cat
}

References
Bash Redirections Cheat Sheet

0

This means that the macOS kernel is missing ALTQ support. Basically, ALTQ are optional various queues in the kernel used by pf(4) for better packets queueing. All of them are disabled inside the kernel and there's no option to enable it.

In your case you might just ignore these lines.

In other OS like OpenBSD or FreeBSD, you can compile kernel with ALTQ enabled (it's a compile-time feature)

  • I understand all that. But for an optional feature, you'd think there would be a way to mute the constant complaining about it. (without having to grep the output) – l008com May 11 at 21:28
  • pfctl(8) has no such option. It warns you to not use ALTQ-related functionality in pf.conf(5) – Eir Nym May 12 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .