Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?

share|improve this question
The same question got re-asked here specifically for rsyslog. –  Caleb Jul 4 '11 at 22:24

2 Answers 2

up vote 5 down vote accepted

How you do this will depend on which log daemon you use, syslog or syslog-ng.

With syslog, you can do this by tweaking a specific log level to only contain iptables messages.

In /etc/syslog.conf:

kern.warning     /var/log/iptables

The set iptables to use that log level:

iptables -A INPUT -j LOG --log-level 4

With syslog-ng you should be able to get a little fancier. Instead of hacking a log level you can filter for content and send that content to a specific log file.

In /etc/syslog-ng/syslog-ng.conf:

destination d_iptables { file("/var/log/iptables"); };
filter f_iptables { match("IN=[A-Za-z0-9\.]* OUT=[A-Za-z0-9\.]*" value("MESSAGE")); };
log { source(s_sys); filter(f_iptables); destination(d_iptables); }
share|improve this answer
I don't have neither '/etc/syslog/' nor '/etc/syslog-ng/' directories on my Ubuntu 10.04 Lucid system. But obviously there is some logging package. In case of 'syslog', as I understand, all messages for 'kern' facility at level 'warning' and above will go to the specified log file, so I can probably end up with mixed-output file also? –  mbaitoff Jul 4 '11 at 10:48
Looks like I have 'rsyslog' installed. –  mbaitoff Jul 4 '11 at 10:50
@mbaitoff: Yes, the level 4 warning was picked because it's not used very often, but yes you COULD end up with a mixup. I'm sorry I don't know rsyslog, but I'm sure there is a similar way to route messages to different log files based on the originating process or filtering. –  Caleb Jul 4 '11 at 10:53
Yes, looks like there is a way to use facility and level specification together with template message filtering and --log-prefix ability to forward matching messages to certain log file. I'd probably open another question regarding the rsyslog-way implementation of such a forwarding (as the manpage is pretty cryptic about it). Thanks for help with syslog and syslog-ng cases. –  mbaitoff Jul 4 '11 at 10:58
What I do on my system is use a unique string in each LOG message that is not likely to appear in other messages (":%FW%:" is what I use currently). You can then tell syslog or syslog-ng to filter any incoming message containing that to its own file. –  ultrasawblade Jul 4 '11 at 13:32

You can use something like this:

:msg,contains,"IPTABLES:" /var/log/iptables
& stop

It should be added before any other rules, for example:

:msg,contains,"IPTABLES:" /var/log/iptables
& stop

auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
cron.*              /var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log

You just change the IPTABLES: to whatever you've set in the LOG target. If you wont use & stop, the message will be logged in both files, the standard /var/log/syslog file and in the /var/log/iptables .

It's a better solution than redirecting all kern.warning messages because in that case you can redirect some other information, not just the one you'd like.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.