I have set logging to high.
I am not seeing any log messages.
I do see the empty ufw.log file.
No messages in dmesg
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.Sign up to join this community
The log files are in:
To get a list of UFW related logs run the following at the command line:
Your results should appear like this:
~$ ls /var/log/ufw* /var/log/ufw.log /var/log/ufw.log.2.gz /var/log/ufw.log.4.gz /var/log/ufw.log.1 /var/log/ufw.log.3.gz
If you do not have logs there you may want to double check the status and settings for UFW.
sudo ufw status verbose
You should get a result like this:
~$ sudo ufw status verbose Status: active Logging: on (low) Default: deny (incoming), allow (outgoing) New profiles: skip
If logging is off then you need to turn it on by running the following command:
sudo ufw logging low
If you do not have any log files then you can check to see if rsyslogd is running by typing:
sudo service rsyslog status
You should get a result as follows:
~$ sudo service rsyslog status rsyslog start/running, process 991
If it does not show that it is running you can try to start the service:
sudo service rsyslog restart
Just to add to @cprofitt's answer, I had an issue where UFW was showing:
sudo ufw status verbose Status: active Logging: on (low)
But it was not logging. I went through several gyrations, including disable/re-enabling ufw. Checking rsyslog conf, restarting rsyslog. All without any positive results. Still nothing going to the logfile.
I did a
sudo ufw logging low and logs started growing once again. So ufw was obviously in some state where it would not write to the logs.
@Carlo Wood, the gentleman who after 8 years still did not get this resolved.
cycle ufw for good measure and/or adjust perms in the file. additionally, as mentioned above, do 'ufw status medium' (or whatever) to confirm it's logging now, and then adjust if you want more or less.
let me know if it's working. i had the same problem, but was able to fix it in minutes after reading this thread and doing what i mentioned in this post.
PS. Note to developer (if they should see this). on fresh installation of ubuntu 20.04 the /var/log/ufw.log doesn't exist. this problem is easily fixed and won't see issues about it if ufw.log is simply created as part of the OS installation process. my thought is it was either overlooked, or was not low enough lying fruit... either way i have seen this issue before and it's always solved by 'touch /var/log/ufw.log'
PSS. after read my PS again i realized i was assuming too much. /var/log/ufw.log should be created on enabling of ufw (as opposed to mega kludge above on creating at OS installation time.
I had the same problem. In my case, none of the above suggestions was helpful. I could resolve the issue in the way described on Stackoverflow: https://stackoverflow.com/questions/42374494/ubuntu-16-ufw-not-logging-in-var-log-ufw-log-neither-another-location/42388079#42388079.
To make things easier:
module(load="imklog")# provides kernel logging support
sudo service rsyslog restart
Logging like a charm since then.