25

Is there a way I can easily redirect the entries for UFW to their own log file at /var/log/ufw instead of filling up /var/log/syslog as it's becoming tricky to find solutions to problems with all this UFW stuff flying past me?

Improve this question
24

In Ubuntu 15.10 and Debian Jessie there is a file /etc/rsyslog.d/20-ufw.conf. It contains at the bottom # & ~. Remove the # in front of it to uncomment it and refresh rsyslog with the command /etc/init.d/rsyslog restart so that it takes in account the configuration change.

Improve this answer
3
  • 3
    works for 14.04 too, and is simpler, just used sudo service rsyslog restart after changing it, thx! – Aquarius Power Sep 27 '16 at 3:01
  • This is what worked for me too (14.04). Simple is good. – pwbred Nov 29 '16 at 1:58
  • 1
    In 18.04 the last line is # & stop but does the same when uncommented, rsyslog needs to be restarted indeed. – Sebastian Mar 2 '19 at 10:45
14

I'm running Ubuntu 14.04 as well. In my /etc/rsyslog.d/ there's a file 20-ufw.conf which has the following line:

:msg,contains,"[UFW " /var/log/ufw.log

What I've done is delete that file, and at the top of 50-default.conf I added the following:

:msg,contains,"[UFW " /var/log/ufw.log
& stop

Restart rsyslog with sudo service rsyslog restart and your UFW logs should be put into their own file and not into any other.

Improve this answer
2
  • 12
    why not just edit 20-ufw.conf and add the stop command there? In fact, it already has a template that can be uncommented, and it seems to work fine in my quick test. – HRJ Dec 4 '14 at 13:49
  • @HRJ Personal preference? The 20-ufw.conf file only has a few lines of text, most of which are comments. I felt it wasn't necessary for its own config file. Your suggestion accomplishes the same thing really - it's the :msg,contains,"[UFW " /var/log/ufw.log that needs to be modified/stopped. – Ackis Dec 5 '14 at 15:21
6

ufw uses rsyslog for logging to /var/log/syslog or /var/log/messages:

To change the log file, edit /etc/rsyslog.d/50-default.conf and to the top add:

:msg, contains, "UFW" -/var/log/ufw.log
& ~

This will log all data that contains "UFW" to /var/log/ufw.log will prevent further processing of such data.

Improve this answer
6
  • While ufw.log does now contain entries with your commands, syslog still receives messages. – markrich Apr 21 '14 at 14:55
  • Yes but syslog does report problems with your commands. – markrich Apr 21 '14 at 15:05
  • error during parsing file /etc/rsyslog.d/50-default.conf, on or before line 1: invalid character '~' - is there an invalid escape sequence somewhere? [try rsyslog.com/e/2207 ] Apr 21 15:58:41 markys-home-pc rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try rsyslog.com/e/2307 ] – markrich Apr 21 '14 at 15:07
  • I did copy and paste. Same error. – markrich Apr 21 '14 at 16:39
  • The log has stopped accepting UFW commands on mass, however one or two are still sneaking through. It's better now however the depreciation error still exists. – markrich Apr 21 '14 at 16:43
5

On 16.04 just comment out the last line in this file so that it reads

$ tail -1 /etc/rsyslog.d/20-ufw.conf 
& stop

and restart rsyslog

$ sudo systemctl restart rsyslog

from now on, ufw logs will be in /var/log/ufw.log and not anymore in /var/log/syslog

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.