Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite

I use ubuntu I want to know where is the log file of iptables?
I find /var/log/messages but I am not sure find correct log file or not.

and also want to know when this log file is changed? I add 1 rule to prevent my machine to respond to ping message but when I ping my machine I didn't any changes to /var/log/messages

share|improve this question

2 Answers

up vote 2 down vote accepted

Because it can easily fill up your logs, the default is to not log. Add a jump to the LOG target, which will log to the kernel log (which you can see with dmesg or at wherever syslog is configured to write that for your distro). In your LOG-target rule, you can set --log-level and --log-prefix to help organize the messages and keep them separate from other kernel messages.

LOG is a "non-terminating target", so rule traversal will continue on to the next rule — you can basically add logging right above your existing rules without affecting them.

share|improve this answer
up vote 5 down vote

IPTables doesn't log unless you add a rule to add a log entry. This is typically done with the -j LOG destination. The log entry is sent to the kernel log, and your syslog daemon determines where kernel log entries go, which seems to be /var/log/messages in your case.

If you want to block pings from a certain host (a fictional 123.456.789.10 for example), and log all those packets, run:

iptables -A INPUT -p icmp --icmp-type 8 --source 123.456.789.10 -j LOG
iptables -A INPUT -p icmp --icmp-type 8 --source 123.456.789.10 -j DROP
share|improve this answer
1  
Do note, however, that logging every single packet marked for dropping is liable to fill up your log filesystem really, really fast... – Shadur Mar 9 '11 at 14:28
Agreed, that's why I only logged for a particular source IP. – jsbillings Mar 9 '11 at 14:49
1  
Adding -m limit --limit 4/min --limit-burst 10 also helps. – stribika Mar 9 '11 at 18:02
I add this rule in my iptables "sudo iptables -A INPUT -p icmp -j LOG" but when I ping my host to entry added to /var/log/messages – Am1rr3zA Mar 10 '11 at 12:03
@Am1rr3zA: what's the question? I don't understand your last comment. If you're using the syntax -A INPUT, that appends to the end of the INPUT table, so any rule that already accepts or rejects the packet would catch it. – jsbillings Mar 10 '11 at 13:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.