Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to log dropped packages to a custom file instead of /var/log/messages.

To achieve this, I have added these two lines at the end of my configuration file:

    -A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-INPUT-Dropped: " --log-level 4
    -A OUTPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-OUTPUT-Dropped: " --log-level 4

This works because I have configured the INPUT and OUTPUT chains as DROP by default, so if the package does not meet any previous rule, it will be logged and dropped.

However, I cannot log them to a custom file. They log successful to /var/log/messages, but I want them to be logged on /var/log/iptables.log. I've created the file /etc/rsyslog.d/iptables.conf with the following content:

    :msg, contains, "IPTables-INPUT-Dropped: " - /var/log/iptables.log
    & ~

then I restarted rsyslog, /etc/init.d/rsyslog restart and sent some packages I knew were going to be dropped.However, they are not logged in iptables.log, they are still being logged on /var/log/messages.

Which configuration is missing?

SOLVED The problem is that there shouldn't be an space between - and /

share|improve this question
    
That should work (I use it). However, I have it in /etc/rsyslog.conf before other directives, so that the message gets dropped before anything else picks it up. Try that and kill -HUP `pidof rsyslogd`. Maybe loose the space at the end of the quoted string. –  goldilocks Aug 31 '13 at 15:03
    
I've added the first line to rsyslog.conf but still it doesn't work –  yzT Aug 31 '13 at 15:24

4 Answers 4

This is a an alternative approach using ulogd. I would suggest this mechanism as it stops the kernel logging mechanism -m LOG uses (which has the grievous side effect of filling your dmesg log as well).

First you'll need ulogd, which you can get with an apt-get install ulogd. Edit your /etc/ulogd.conf, enable this module (by removing the # at the start of the line):

plugin="/usr/lib/ulogd/ulogd_LOGEMU.so"

and change/add the section [LOGEMU]:

[LOGEMU]
file="/var/log/iptables.log"
sync=1

And then restart your ulogd with /etc/init.d/ulogd restart. Then instead of -j LOG use -j ULOG on your iptables rules. The ULOG module has no concept of --log-level so you can remove those options. It also uses --ulog-prefix instead of --log-prefix.

share|improve this answer
    
it does not work. –  yzT Aug 31 '13 at 15:27
    
Did you restart the ulogd after adding the entry? (/etc/init.d/ulogd restart as root) –  Drav Sloan Aug 31 '13 at 15:28
    
yeah, of course. Actually it is ulogd2 rather than ulogd –  yzT Aug 31 '13 at 15:29
    
ah you need another step will add it to the answer. –  Drav Sloan Aug 31 '13 at 15:31
    
Nop, it comes enabled by default. –  yzT Aug 31 '13 at 15:36

This can be possible using :

To disable iptables logs in syslog , do modification as below in /etc/rsyslog.d/50-default.conf:

*.*;auth,authpriv.none;kern.*=!kern.warning             -/var/log/syslog

To log in separate file; append :

kern.=warning -/var/log/iptables.log

then once restart syslog or rsyslog and tail the logs

/etc/init.d/rsyslog restart

It's works in syslog and rsyslog also

share|improve this answer
up vote 0 down vote accepted

The problem is that there shouldn't be a space between - and /

share|improve this answer

FYI:

& ~ is deprecated in the new rsyslog, you should use stop instead.

/etc/rsyslog.d/10-iptables

if ( $msg contains 'IN=' and $msg contains 'OUT=' ) 
then { 
    /var/log/10-iptables.log
    stop
}

/etc/logrotate.d/iptables

/var/log/iptables.log
{
        rotate 30
        daily
        missingok
        notifempty
        delaycompress

        postrotate
                service rsyslog rotate > /dev/null
        endscript
}

Note i set the prefix to 10- to catch it before it reach the default rules (50-defaults).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.