Is there a way to log to file all the outgoing connections that a process creates? I am aware of netstat but that seems to be more of a snapshot of a point in time rather than something that runs and logs information over a period.

I only need the IP or hostname, port and the process making the connection.


4 Answers 4


On Linux, you can set up the audit subsystem to log every attempt to establish a network connection. For information about the audit subsystem, read the auditctl man page or this tutorial or other examples on this site. Install your distribution's auditd package if necessary, then

auditctl -A exit,always -S connect

The logs are in /var/log/audit/audit.log on all the distributions that I know of. You can also search them with ausearch.

  • 4
    I needed to identify which process was making an outgoing connection. This did it instantly. To avoid flooding the logs, remove the rule afterward: auditctl -d exit,always -S connect May 26, 2013 at 3:59
  • How do I inspect the logs? Jul 12, 2019 at 16:50
  • @luckydonald less /var/log/audit/audit.log Jul 12, 2019 at 19:36
  • 1
    This seems to log a huge amount of data, though having tried a curl - the ip address was NOT logged in the /var/log/audit/audit.log file. Aug 7, 2020 at 11:38
  • The IP address and port are part of the saddr field. See: unix.stackexchange.com/questions/102926/… Oct 7, 2020 at 13:05

If you're able to install a custom kernel, you should have a look at SystemTap. There are plenty of examples how to trace network activity.


On Linux, you can use ip_conntrack to accomplish this. It's a connection tracking module, used normally to monitor connections for oddly behaving protocols (like FTP) to be managed by a firewall/NAT box.

modprobe ip_conntrack
cat /proc/net/ip_conntrack

You can grep the pseudo-file to see established connections, and further grep the source IP to see when it originates from your box.

  • The question may not be necessarily Linux-centric.
    – Karlson
    Jan 26, 2012 at 18:22

I would look into using tcpdump on the outbound interface looking at the outbound SYN requests.

If you feel really adventurous you could make utilities like: strace or truss report all connect system calls while tracing the execution of the program but this is a bit more dangerous and has drawbacks when dealing with multithreaded processes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .