28

Is there a way I can easily redirect the entries for UFW to their own log file at /var/log/ufw instead of filling up /var/log/syslog as it's becoming tricky to find solutions to problems with all this UFW stuff flying past me?

5 Answers 5

25

In Ubuntu 15.10 and Debian Jessie there is a file /etc/rsyslog.d/20-ufw.conf. It contains at the bottom # & ~. Remove the # in front of it to uncomment it and refresh rsyslog with the command /etc/init.d/rsyslog restart so that it takes in account the configuration change.

3
  • 3
    works for 14.04 too, and is simpler, just used sudo service rsyslog restart after changing it, thx! Sep 27, 2016 at 3:01
  • This is what worked for me too (14.04). Simple is good.
    – pwbred
    Nov 29, 2016 at 1:58
  • 2
    In 18.04 the last line is # & stop but does the same when uncommented, rsyslog needs to be restarted indeed.
    – Sebastian
    Mar 2, 2019 at 10:45
14

I'm running Ubuntu 14.04 as well. In my /etc/rsyslog.d/ there's a file 20-ufw.conf which has the following line:

:msg,contains,"[UFW " /var/log/ufw.log

What I've done is delete that file, and at the top of 50-default.conf I added the following:

:msg,contains,"[UFW " /var/log/ufw.log
& stop

Restart rsyslog with sudo service rsyslog restart and your UFW logs should be put into their own file and not into any other.

2
  • 12
    why not just edit 20-ufw.conf and add the stop command there? In fact, it already has a template that can be uncommented, and it seems to work fine in my quick test.
    – HRJ
    Dec 4, 2014 at 13:49
  • @HRJ Personal preference? The 20-ufw.conf file only has a few lines of text, most of which are comments. I felt it wasn't necessary for its own config file. Your suggestion accomplishes the same thing really - it's the :msg,contains,"[UFW " /var/log/ufw.log that needs to be modified/stopped.
    – Ackis
    Dec 5, 2014 at 15:21
6

ufw uses rsyslog for logging to /var/log/syslog or /var/log/messages:

To change the log file, edit /etc/rsyslog.d/50-default.conf and to the top add:

:msg, contains, "UFW" -/var/log/ufw.log
& ~

This will log all data that contains "UFW" to /var/log/ufw.log will prevent further processing of such data.

6
  • While ufw.log does now contain entries with your commands, syslog still receives messages.
    – markrich
    Apr 21, 2014 at 14:55
  • Yes but syslog does report problems with your commands.
    – markrich
    Apr 21, 2014 at 15:05
  • error during parsing file /etc/rsyslog.d/50-default.conf, on or before line 1: invalid character '~' - is there an invalid escape sequence somewhere? [try rsyslog.com/e/2207 ] Apr 21 15:58:41 markys-home-pc rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try rsyslog.com/e/2307 ]
    – markrich
    Apr 21, 2014 at 15:07
  • I did copy and paste. Same error.
    – markrich
    Apr 21, 2014 at 16:39
  • The log has stopped accepting UFW commands on mass, however one or two are still sneaking through. It's better now however the depreciation error still exists.
    – markrich
    Apr 21, 2014 at 16:43
6

On 16.04 just comment out the last line in this file so that it reads

$ tail -1 /etc/rsyslog.d/20-ufw.conf 
& stop

and restart rsyslog

$ sudo systemctl restart rsyslog

from now on, ufw logs will be in /var/log/ufw.log and not anymore in /var/log/syslog

1

I cannot post a comment yet with my reputation, hence posting a separate response.

chmike's answer still works for Ubuntu 20.04 (with a slight change). Basically

go to /etc/rsyslog.d/20-ufw.conf
Uncomment the last line: # & stop (i.e. delete #)
then restart rsyslog (i.e. /etc/init.d/rsyslog restart)
1
  • @David nevertheless, he/she can't comment yet. Feb 24, 2022 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.