#10 ICMP entries in my kern.log

[Murray Collingwood]

Logwatch 7.5.5 (released 01/22/21)

I'm getting lots of ICMP entries in my logwatch reports, like this:

 From 1.132.106.160 - 1 packet to icmp(3)
 From 3.65.20.94 - 1 packet to icmp(8)

So I did some reading about these, and we are strongly advised not to disable ICMP (with the sole exception of the 'redirect' option). So why am I see hundreds of these messages in my logwatch reports every day.
In the above example, I believe 3 is an unreachable destination, probably somebody phishing for open ports on my server, and 8 is a ping. Why is somebody on Amazon (maybe an AWS user) pinging my machine?

I'm not supposed to disable these ICMP options, so can we remove them from the logwatch output?

Cheers
Murray

[Murray Collingwood]

Is anybody watching these tickets????

[Frank Crawford]

Murray, I'll take a shot at this, as a long time user and occassional contributor.
First off, logwatch only reports what is in the logs, it does not interpret if they are good or bad. The fact you are getting these logged really goes back to your firewall package, and you may want to see if you can supress the logging from there. Note, I say supress the logging, not disable the actual rule.
Now if that is not possible for whatever reason, you should look at the documenataion on how to customise logwatch, see the file HOWTO-Customize-LogWatch, there are options listed there on how to supress certain matches, either at an individual module level or globally. As you haven't listed which module, although I assume it is the firewall, I can't give specific details.
Feel free to to reply and I will see what I can add.

Regards
Frank