I'm trying to log dropped packages to a custom file instead of
To achieve this, I have added these two lines at the end of my configuration file:
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-INPUT-Dropped: " --log-level 4 -A OUTPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-OUTPUT-Dropped: " --log-level 4
This works because I have configured the INPUT and OUTPUT chains as DROP by default, so if the package does not meet any previous rule, it will be logged and dropped.
However, I cannot log them to a custom file. They log successful to
/var/log/messages, but I want them to be logged on
/var/log/iptables.log. I've created the file
/etc/rsyslog.d/iptables.conf with the following content:
:msg, contains, "IPTables-INPUT-Dropped: " - /var/log/iptables.log & ~
then I restarted rsyslog,
/etc/init.d/rsyslog restart and sent some packages I knew were going to be dropped.However, they are not logged in iptables.log, they are still being logged on
Which configuration is missing?
SOLVED The problem is that there shouldn't be an space between - and /