home firewall log tweaking
When you configure your home firewall, do you log everything?
I like to poke around in my firewall logs... but its a lot of the same.
Scans for port 137,139,1026,1027,1433,1444, etc.
You know the drill. With all that in there, it becomes very boring looking through.
So, I decided to just not log those specific ports denied inbound (the most common hit ports most likely generated by worms). I still log everything that is permitted inbound. A benefit of it might be that it'll use less resources sending those over to syslog?
Is that a stupid thing to do?
Now when I look at it... I'll notice the stuff that isn't so common. (generated by worms or scripts)
Not that I expect much...