16

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here).

From looking at man iptables those two look quite alike. Except that NFLOG talks about some "nfnetlink_log backend" while ULOG doesn't talk about any backend.

  1. What's the difference?
  2. Are there typical situations for using one or the other?
Improve this question

1 Answer 1

Reset to default
17

ULOG was the original user space logging added in Kernel 2.4 for ipv4.

NFLOG is the newer, generic (layer3 independent) logging framework for 2.6 kernels based on the original ULOG but implemented via libnfnetlink

Both will send logs to ulogd which will then log via whatever output plugin you choose.

Use ULOG if you are stuck with ulogd-1.x as 1.x might not play nicely with NFLOG. You really should be using ulogd-2.x as 1.x is considered legacy and is EOL.

Otherwise, just use NFLOG

Improve this answer
6
  • 1
    Note that ulogd 1.24 (as shipped on Debian/stable) doesn't seem to like NFLOG, but seems to like ULOG.
    – Elrond
    Jun 21, 2014 at 23:35
  • ah debian.. always so stable =) added a note to the A. Also jessie will be moving to ulogd-2.x
    – Matt
    Jun 23, 2014 at 11:43
  • Is there any way to detect which one a system is capable of using so that a wrapper script can always use the right one?
    – user1169420
    Feb 18, 2019 at 16:44
  • 1
    @user1169420, maybe like this: if ulogd --version | grep -q 'Version 2'; then (use NFLOG); else (use ULOG); fi
    – MarSoft
    Mar 18, 2019 at 22:49
  • And what about the regular LOG?, what relation does it hold against the others?.
    – Jaime Hablutzel
    May 6, 2019 at 23:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.