Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here).

From looking at man iptables those two look quite alike. Except that NFLOG talks about some "nfnetlink_log backend" while ULOG doesn't talk about any backend.

  1. What's the difference?
  2. Are there typical situations for using one or the other?

1 Answer 1


ULOG was the original user space logging added in Kernel 2.4 for ipv4.

NFLOG is the newer, generic (layer3 independent) logging framework for 2.6 kernels based on the original ULOG but implemented via libnfnetlink

Both will send logs to ulogd which will then log via whatever output plugin you choose.

Use ULOG if you are stuck with ulogd-1.x as 1.x might not play nicely with NFLOG. You really should be using ulogd-2.x as 1.x is considered legacy and is EOL.

Otherwise, just use NFLOG

  • 1
    Note that ulogd 1.24 (as shipped on Debian/stable) doesn't seem to like NFLOG, but seems to like ULOG.
    – Elrond
    Commented Jun 21, 2014 at 23:35
  • ah debian.. always so stable =) added a note to the A. Also jessie will be moving to ulogd-2.x
    – Matt
    Commented Jun 23, 2014 at 11:43
  • Is there any way to detect which one a system is capable of using so that a wrapper script can always use the right one? Commented Feb 18, 2019 at 16:44
  • 1
    @user1169420, maybe like this: if ulogd --version | grep -q 'Version 2'; then (use NFLOG); else (use ULOG); fi
    – MarSoft
    Commented Mar 18, 2019 at 22:49
  • 1
    @JaimeHablutzel LOG writes to the kernel log, so is grouped in with the other kernel logging and can take over the ring buffer if you are logging a lot. Generally this will go to the journal/syslog where you can forward it to other targets. NFLOG allows you to manage the iptables logging/targets outside of the kernel route
    – Matt
    Commented May 20, 2019 at 7:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .