4

I have a system with Debian Jessie. It comes with systemd. I want to see the kernel logs for iptables.

I have a bunch of iptables and at the end I want to log what doesn't get allowed. I do it like this:

iptables -A INPUT -j LOG

With syslog I could see the iptables logs doing this: tail -f /var/log/syslog | grep kernel With systemd I can't find a way to see what is failing. I've been trying journalctl and journalctl -f. journalctl alone shows a lot, doing a grep -v of what I am not interested I still can't see anything about iptables.

I also tried what is supposed to show kernel messages but I see nothing but when it started logging:

journalctl -k

I am trying to find out if iptables is a service or what, but I can't see it with:

systemctl --full list-units --type=service

I tried following this post about systemd and logs in general, but I still get no clue about how can I see iptables logs: https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs

Any hints ? thank you very much.

1

Debian Jessie does not remove syslog support by default. The old way (grepping through logs) should still work.

If you somehow accidentally removed syslog yourself, reinstall it:

apt install rsyslog
  • Thank you Wouter, that was a good starting point. It was a fresh Jessie install and it comes with no rsyslog by default. After installing it I do see some logs, ie ssh connections. But I still get no iptables logs. To make sure I just wrote a single rule: iptables -A INPUT -j LOG. I don't know what to try now. – Francesc Guasch Feb 5 '16 at 10:02
  • Note that kernel logs are written to kern.log by default. Did you check that file? – Wouter Verhelst Feb 5 '16 at 10:04
  • Yes, I did tail -f messages auth.log syslog kern.log – Francesc Guasch Feb 5 '16 at 10:06
  • Did you figure out the solution to this? I'm facing the same problem, on a Debian Jessie box as well. – tomorrow__ Jun 30 '16 at 10:29
  • @kai I did not. It still show no logs from iptables. I have other jessie servers and those work fine. The only difference is this one is inside an LXC container, so I think I can blame it to something related to LXC. – Francesc Guasch Jul 13 '16 at 11:17
0

iptables -j LOG is logged to kernel. look forIN= and OUT= in either kernel.log (if systemd logs to drive) or in journalctl -k, probably dmesg will list them as well. Example:

journalctl -k | grep "IN=.*OUT=.*" | less
  • 1
    My kernel log is empty. It just shows when it began, nothing else: # journalctl -k -- Logs begin at dv 2016-09-02 13:51:34 CEST, end at dv 2016-09-23 12:39:01 CEST – Francesc Guasch Sep 23 '16 at 10:40
0

Try to play with log-levels: journalctl -k --priority=[0-7] or add --log-level=[0-7] to after your -j LOG to iptables, or both and you will definetly know on which level to search for those logs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.