0

I have firewalld installed in a remote CentOS server. When I log into the server over the internet as root, I type the following command to access the firewalld logs:

journalctl --output=json-pretty UNIT=firewalld.service  

The result is a few records indicating when the service was turned on, etc.

How do I get the list of attempts that remote users tried to connect with the server? Including ip addresses, whether or not they where blocked by firewalld, what they were requesting, what ports, etc.

2

If there is no logging specified in the firewall rule that rejects the connection attempts, then nothing will appear in the log.

I suggest you read the RedHat firewalld reference which discusses adding logging requirements to firewall rules. Unfortunately, it's fairly complex and there are no shortcuts that I know of.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.