I have this rule in my iptables:
iptables -A INPUT -s 192.168.11.0/24 -j LOG
My question is:
Where is the iptables log file, and how can I change that?
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.Sign up to join this community
These logs are generated by the kernel, so they go to the file that receives kernel logs:
If you want to redirect these logs to a different file, that can't be done through iptables. It can be done in the configuration of the program that dispatches logs: rsyslog. In the iptables rule, add a prefix that isn't used by any other kernel log:
iptables -A INPUT -s 192.168.11.0/24 -j LOG --log-prefix='[netfilter] '
Following the example set by
20-ufw.conf, create a file under
:msg,contains,"[netfilter] " -/var/log/iptables.log & stop
Putting the rule early (the file names in
/etc/rsyslog.d are used in lexicographic order) and adding
&stop causes these logs to go only to the specified location and not to the default location as well.
Rsyslog has to be restarted for the config changes to take place.
If you are in trouble finding the right file you may try like this:
find /var/log -mmin 1
This will find any file modified in the last 1 min inside the
/var/log and below.
You may find out that the
-j LOG may update more than just a single file.
For instance on Ubuntu 18, both the
/var/log/syslog are impacted with netfilter logging.
# on my computer ! # i wrote at the top of the script iptables -F iptables -X # iptables -A INPUT -m state --state NEW -j LOG \ --log-prefix='[iptables_input] ' iptables -A OUTPUT -m state --state NEW -j LOG \ --log-prefix='[iptables_output] ' # and found the results in /var/log/syslog # the LOG instruction are executed only when other iptables instructions # are not registered before