14

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here).

From looking at man iptables those two look quite alike. Except that NFLOG talks about some "nfnetlink_log backend" while ULOG doesn't talk about any backend.

  1. What's the difference?
  2. Are there typical situations for using one or the other?
| improve this question | |
15

ULOG was the original user space logging added in Kernel 2.4 for ipv4.

NFLOG is the newer, generic (layer3 independent) logging framework for 2.6 kernels based on the original ULOG but implemented via libnfnetlink

Both will send logs to ulogd which will then log via whatever output plugin you choose.

Use ULOG if you are stuck with ulogd-1.x as 1.x might not play nicely with NFLOG. You really should be using ulogd-2.x as 1.x is considered legacy and is EOL.

Otherwise, just use NFLOG

| improve this answer | |
  • 1
    Note that ulogd 1.24 (as shipped on Debian/stable) doesn't seem to like NFLOG, but seems to like ULOG. – Elrond Jun 21 '14 at 23:35
  • ah debian.. always so stable =) added a note to the A. Also jessie will be moving to ulogd-2.x – Matt Jun 23 '14 at 11:43
  • Is there any way to detect which one a system is capable of using so that a wrapper script can always use the right one? – user1169420 Feb 18 '19 at 16:44
  • 1
    @user1169420, maybe like this: if ulogd --version | grep -q 'Version 2'; then (use NFLOG); else (use ULOG); fi – MarSoft Mar 18 '19 at 22:49
  • And what about the regular LOG?, what relation does it hold against the others?. – Jaime Hablutzel May 6 '19 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.