Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

There are comments in the /etc/rsyslog.d/20-ufw.conf file that give you the option to keep UFW-events from being logged to the kernel and message logs, which i have done.

I would really like to get UFW-events out of the dmesg as well, but how to accomplish that?

share|improve this question
2  
As a work around for now I've just aliased dmesg with dmesg | grep -v UFW. –  3dinfluence Nov 2 '10 at 14:10
add comment

4 Answers

I have done some investigation into this issue.

I don't believe there is a way around this.

The dmesg command directly prints the contents of the Kernel Ring Buffer. This contains all the ufw log entries that you are seeing.

The /etc/rsyslog.d/20-ufw.conf file is telling rsyslog which of the ufw entries in the Kernel Ring Buffer to log to either the /var/log/ufw.log or /var/log/kern.log.

You can prevent the ufw entries from being logged to /var/log/kern.log (to remove duplication) by uncommenting the line in /etc/rsyslog.d/20-ufw.conf that contains & ~.

Unfortunately there is no way to prevent the dmesg command from displaying these messages. Your work around is the best I can come up with.

share|improve this answer
    
Chris thanks for looking into this. +1 for the effort. I'm going to leave the question unanswered for now though to see if anyone else has any ideas. Perhaps there's no solution to this and I'll file a bug on launchpad as I'm sure there are others who like to keep an eye on dmesg to make sure there's no hardware issues going on with their server and don't care to see the UFW entries. –  3dinfluence Nov 6 '10 at 2:10
    
Just to pick up on your mentioning bug reports: (archived) Debian bug #664748 and Launchpad bug #555852 now seem to track this issue. –  Jani Uusitalo Feb 18 '13 at 15:27
add comment

For people who would like to fine tune the log level further, I suggest using 'log' or reject/deny rules (see the ufw man page for details). For exampe, you can use 'logging off' and then insert explicit logging rules for what you want to log. Alternatively, you can use 'logging low' and then insert explicit deny/reject rules to quietly deny matches that would otherwise be logged.

share|improve this answer
add comment

Someone came up with a workaround here, and I think it's pretty neat. Just add this alias:

alias dmesg="dmesg | sed '/UFW/d'"
share|improve this answer
add comment

You can disable UFW logging with following command from shell:

ufw logging off

Default loglevel is medium. From ufw man page:

  • off disables ufw managed logging
  • low logs all blocked packets not matching the default policy (with rate limiting), as well as packets matching logged rules
  • medium log level low, plus all allowed packets not matching the default policy, all INVALID packets, and all new connections. All logging is done with rate limiting.
  • high log level medium (without rate limiting), plus all packets with rate limiting
  • full log level high without rate limiting
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.