I have this rule in my iptables:

iptables -AINPUT -s 192.168.11.0/24 -j LOG

My question is:

Where is the iptables log file, and how can I change that?

up vote 47 down vote accepted

These logs are generated by the kernel, so they go to the file that receives kernel logs: /var/log/kern.log.

If you want to redirect these logs to a different file, that can't be done through iptables. It can be done in the configuration of the program that dispatches logs: rsyslog. In the iptables rule, add a prefix that isn't used by any other kernel log:

iptables -A INPUT -s 192.168.11.0/24 -j LOG --log-prefix='[netfilter] '

Following the example set by 20-ufw.conf, create a file under /etc/rsyslog.d/my_iptables.conf containing

:msg,contains,"[netfilter] " /var/log/iptables.log
  • i dont have installed ufw, so i cannot find logs in syslog,kern.log or iptables.log – pylover Sep 21 '13 at 19:47
  • 3
    @pylover UFW was just an example. I know you don't have iptables.log, the point of my answer is to show you how to create it. You may not have /var/log/kern.log if you're running a different version of Ubuntu (I think recent versions no longer use this file and put kernel logs in /var/log/syslog instead), but it doesn't matter. Oh, but if you're running an older version of Ubuntu, you may need to install the rsyslog package. – Gilles Sep 21 '13 at 19:50
  • To make this work on 12.10, I had to adjust the rsyslog.d file to have the following additional char: ":msg,contains,"[netfilter] " -/var/log/iptables.log" – Daniel Feb 26 '14 at 15:10
  • 1
    one more thing, i needed to name the file like 00-my_iptables.conf, otherwise iptables still were logging into kern.log – Valentin Kantor Jan 3 '15 at 12:02
  • Maybe you could mentioned the & stop command as well. That way you avoid duplicates in the kern.log file, duplicates that could imper your ability to see other important kernel logs. – Alexis Wilke Oct 21 '16 at 20:08

I know that's far too late and the answer is already marked as the accepted one. I just have a piece of new info to give.

The log file of the LOG action is found at either /var/log/syslog (Ubuntu and similar OSs) or /var/log/messages (CentOS and similar OSs).

If you are in trouble finding the right file you may try like this:

find /var/log -mmin 1

This will find any file modified in the last 1 min inside the /var/log and below. You may find out that the -j LOG may update more than just a single file.

For instance on Ubuntu 18, both the /var/log/kern.log and /var/log/syslog are impacted with netfilter logging.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.