Is it possible to change the log format of iptables ?

I want to add the ssh_client in the log.

I have already made an iptables rule for outgoing ssh

iptables -I OUTPUT -p tcp --dport 22 -j LOG --log-prefix "outbound ssh ${SSH_CLIENT%% *} : " --log-ip-options "${SSH_CLIENT%% *}" --syn

But I want the variable ${SSH_CLIENT%% *} to be dynamic and not static.


You can't have a dynamic --log-prefix when using iptables. However, since SSL_CLIENT holds the source IP address you could look in the SRC="..." field to obtain it.

  • No the SRC="..." is different than $SSH_CLIENT And in the iptable log i want the SRC address and the $SSH_CLIENT Because i want to know if a ssh session open another ssh session – hamza May 6 '15 at 11:16
  • i want to know if they are a solution to change the iptables log to add this information – hamza May 6 '15 at 11:24
  • 1
    @Hamza, can you please explain in your Question why you're seeing SRC as different to the IP address in $SSH_CLIENT. Even with ssh over a tunnelled connection I cannot see how they would be significantly different. – roaima May 6 '15 at 11:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.