8

I have a system with Debian Jessie. It comes with systemd. I want to see the kernel logs for iptables.

I have a bunch of iptables and at the end I want to log what doesn't get allowed. I do it like this:

iptables -A INPUT -j LOG

With syslog I could see the iptables logs doing this: tail -f /var/log/syslog | grep kernel With systemd I can't find a way to see what is failing. I've been trying journalctl and journalctl -f. journalctl alone shows a lot, doing a grep -v of what I am not interested I still can't see anything about iptables.

I also tried what is supposed to show kernel messages but I see nothing but when it started logging:

journalctl -k

I am trying to find out if iptables is a service or what, but I can't see it with:

systemctl --full list-units --type=service

I tried following this post about systemd and logs in general, but I still get no clue about how can I see iptables logs: https://www.digitalocean.com/community/tutorials/how-to-use-journalctl-to-view-and-manipulate-systemd-logs

Any hints ? thank you very much.

Improve this question

3 Answers 3

Reset to default
3

iptables -j LOG is logged to kernel. look forIN= and OUT= in either kernel.log (if systemd logs to drive) or in journalctl -k, probably dmesg will list them as well. Example:

journalctl -k | grep "IN=.*OUT=.*" | less
Improve this answer
1
  • 1
    My kernel log is empty. It just shows when it began, nothing else: # journalctl -k -- Logs begin at dv 2016-09-02 13:51:34 CEST, end at dv 2016-09-23 12:39:01 CEST
    – Francesc Guasch
    Sep 23, 2016 at 10:40
1

Debian Jessie does not remove syslog support by default. The old way (grepping through logs) should still work.

If you somehow accidentally removed syslog yourself, reinstall it:

apt install rsyslog
Improve this answer
5
  • Thank you Wouter, that was a good starting point. It was a fresh Jessie install and it comes with no rsyslog by default. After installing it I do see some logs, ie ssh connections. But I still get no iptables logs. To make sure I just wrote a single rule: iptables -A INPUT -j LOG. I don't know what to try now.
    – Francesc Guasch
    Feb 5, 2016 at 10:02
  • Note that kernel logs are written to kern.log by default. Did you check that file?
    – Wouter Verhelst
    Feb 5, 2016 at 10:04
  • Yes, I did tail -f messages auth.log syslog kern.log
    – Francesc Guasch
    Feb 5, 2016 at 10:06
  • Did you figure out the solution to this? I'm facing the same problem, on a Debian Jessie box as well.
    – sudokai
    Jun 30, 2016 at 10:29
  • @kai I did not. It still show no logs from iptables. I have other jessie servers and those work fine. The only difference is this one is inside an LXC container, so I think I can blame it to something related to LXC.
    – Francesc Guasch
    Jul 13, 2016 at 11:17
1

Try to play with log-levels: journalctl -k --priority=[0-7] or add --log-level=[0-7] to after your -j LOG to iptables, or both and you will definetly know on which level to search for those logs.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .