3

UFW is enabled and logging is set to HIGH on my Arch Linux system. I am sure that it is running and blocking some of my connection attempts. However I cannot find any logs. The places/commands I tried to check:

  • journalctl -u ufw
  • journalctl | grep ufw
  • /var/log/ufw* (not found)
  • /var/log/messages (not found)
  • /var/log/syslog (not found)
  • /var/log/kern.log (not found)

Where are the logs for UFW located on Arch Linux?

4

If there is no additional logger configured, all UFW events should be logged to systemd journal by default.

UFW entries have the following format:

Sep 13 21:52:11 xps kernel: [UFW BLOCK] IN=wlp58s0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.103 DST=192.168.1.209 LEN=545 TOS=0x00 PREC
Sep 13 21:52:12 xps kernel: [UFW BLOCK] IN=wlp58s0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.103 DST=192.168.1.209 LEN=545 TOS=0x00 PREC
Sep 13 21:52:13 xps kernel: [UFW BLOCK] IN=wlp58s0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.103 DST=192.168.1.209 LEN=545 TOS=0x00 PREC

Try journalctl | grep -i ufw to search for all UFW entries regardless letter case.

  • This case is indeed a letter case. Thank you. – Teo Sep 18 '16 at 9:02
  • Is there a reason that this isn't categorized as a unit? journalctl -u ufw is much more intuitive, it seems strange that it's not logging there. – Nathan Apr 12 '17 at 5:42
  • @Nathan You are right, in fact ufw is categorized as a unit (at least now it is), so journalctl -u ufw is the best solution. I just tried to fix the example with grep that had been posted in original question. – zoresvit Apr 12 '17 at 16:18
  • 1
    @zoresvit I meant that journalctl -u ufw doesn't appear to work (at least on my machine), but the grep solution does. journalctl -u ufw gives me a short log of the startup/stopping of the unit, but doesn't give an actual verbose log-- and I was curious if you knew why that was. – Nathan Apr 12 '17 at 19:52
  • @Nathan Oh, I didn't notice that — I don't use it normally, so didn't see much difference in the output. – zoresvit Apr 12 '17 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.