I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?


2 Answers 2


How you do this will depend on which log daemon you use, syslog or syslog-ng.

With syslog, you can do this by tweaking a specific log level to only contain iptables messages.

In /etc/syslog.conf:

kern.warning     /var/log/iptables

The set iptables to use that log level:

iptables -A INPUT -j LOG --log-level 4

With syslog-ng you should be able to get a little fancier. Instead of hacking a log level you can filter for content and send that content to a specific log file.

In /etc/syslog-ng/syslog-ng.conf:

destination d_iptables { file("/var/log/iptables"); };
filter f_iptables { match("IN=[A-Za-z0-9\.]* OUT=[A-Za-z0-9\.]*" value("MESSAGE")); };
log { source(s_sys); filter(f_iptables); destination(d_iptables); }
  • I don't have neither '/etc/syslog/' nor '/etc/syslog-ng/' directories on my Ubuntu 10.04 Lucid system. But obviously there is some logging package. In case of 'syslog', as I understand, all messages for 'kern' facility at level 'warning' and above will go to the specified log file, so I can probably end up with mixed-output file also?
    – mbaitoff
    Jul 4, 2011 at 10:48
  • Looks like I have 'rsyslog' installed.
    – mbaitoff
    Jul 4, 2011 at 10:50
  • @mbaitoff: Yes, the level 4 warning was picked because it's not used very often, but yes you COULD end up with a mixup. I'm sorry I don't know rsyslog, but I'm sure there is a similar way to route messages to different log files based on the originating process or filtering.
    – Caleb
    Jul 4, 2011 at 10:53
  • Yes, looks like there is a way to use facility and level specification together with template message filtering and --log-prefix ability to forward matching messages to certain log file. I'd probably open another question regarding the rsyslog-way implementation of such a forwarding (as the manpage is pretty cryptic about it). Thanks for help with syslog and syslog-ng cases.
    – mbaitoff
    Jul 4, 2011 at 10:58
  • 1
    What I do on my system is use a unique string in each LOG message that is not likely to appear in other messages (":%FW%:" is what I use currently). You can then tell syslog or syslog-ng to filter any incoming message containing that to its own file.
    – LawrenceC
    Jul 4, 2011 at 13:32

You can use something like this:

:msg,contains,"IPTABLES:" /var/log/iptables
& stop

It should be added before any other rules, for example:

:msg,contains,"IPTABLES:" /var/log/iptables
& stop

auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
cron.*              /var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log

You just change the IPTABLES: to whatever you've set in the LOG target. If you wont use & stop, the message will be logged in both files, the standard /var/log/syslog file and in the /var/log/iptables .

It's a better solution than redirecting all kern.warning messages because in that case you can redirect some other information, not just the one you'd like.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .