I'm trying to log dropped packages to a custom file instead of /var/log/messages
.
To achieve this, I have added these two lines at the end of my configuration file:
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-INPUT-Dropped: " --log-level 4
-A OUTPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-OUTPUT-Dropped: " --log-level 4
This works because I have configured the INPUT and OUTPUT chains as DROP by default, so if the package does not meet any previous rule, it will be logged and dropped.
However, I cannot log them to a custom file. They log successful to /var/log/messages
, but I want them to be logged on /var/log/iptables.log
. I've created the file /etc/rsyslog.d/iptables.conf
with the following content:
:msg, contains, "IPTables-INPUT-Dropped: " - /var/log/iptables.log
& ~
then I restarted rsyslog, /etc/init.d/rsyslog restart
and sent some packages I knew were going to be dropped.However, they are not logged in iptables.log, they are still being logged on /var/log/messages
.
Which configuration is missing?
SOLVED The problem is that there shouldn't be an space between - and /
/etc/rsyslog.conf
before other directives, so that the message gets dropped before anything else picks it up. Try that andkill -HUP `pidof rsyslogd`
. Maybe loose the space at the end of the quoted string.