Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have set logging to high.

I am not seeing any log messages.

I do see the empty ufw.log file.

No messages in dmesg

share|improve this question
    
Check this in the terminal "Sudo Ufw status" if the yfw is enabled you may have a problem with loging events –  Prasad RD Mar 16 '12 at 9:09
    
status says: logging high, so ufw thinks logging is set correctly. Any clues on how I can proceed? –  sureshvv Mar 16 '12 at 9:41
    
if any of these answers "answered" your question please accept one of them :) –  blade19899 Jul 11 '12 at 16:03
add comment

2 Answers

last time i checked the log file for ufw it was in the

/var/log/ufw.log

folder, with a lot of other files

share|improve this answer
    
/var/log/ufw.log is an empty file - not a folder for me –  sureshvv Mar 16 '12 at 8:40
    
No, what he mentioned there is the log folder!. Anyone knows it isn't a folder if it ends with an extension :-) –  Prasad RD Mar 16 '12 at 9:47
1  
not true of the .d extension...and it's a 1 rep asker...so maybe not 'Anyone' –  hbdgaf Mar 16 '12 at 9:55
1  
Sorry then, that is the far as i know –  Prasad RD Mar 16 '12 at 10:12
add comment

The log files are in:

/var/log/

To get a list of UFW related logs run the following at the command line:

ls /var/log/ufw*

Your results should appear like this:

~$ ls /var/log/ufw*
/var/log/ufw.log    /var/log/ufw.log.2.gz  /var/log/ufw.log.4.gz
/var/log/ufw.log.1  /var/log/ufw.log.3.gz

If you do not have logs there you may want to double check the status and settings for UFW.

sudo ufw status verbose

You should get a result like this:

~$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing)
New profiles: skip

If logging is off then you need to turn it on by running the following command:

sudo ufw logging low

If you do not have any log files then you can check to see if rsyslogd is running by typing:

sudo service rsyslog status

You should get a result as follows:

~$ sudo service rsyslog status
rsyslog start/running, process 991

If it does not show that it is running you can try to start the service:

sudo service rsyslog restart

share|improve this answer
    
rsyslog was running. I restarted. logging level already set to high. Still no joy! ufw.log is empty. What events are logged? Will attempt to access any port that has a DENY rule be logged? –  sureshvv Mar 17 '12 at 3:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.