Somehow an iptables rule was added to one of my systems. Does (or can) iptables keep a log about when and (maybe) who made a rule change? If iptables itself can't, is there a wrapper that might do that? I know sudo logs commands, but once someone does "sudo su -", that is the end of that.
No, there is no change log for iptables.
Since only root can run
If you use
If you want the logging to happen automatically, replace the