My os :centos 7.

yum remove firewalld
yum install  -y iptables
yum install -y iptables-services

I want to log all the ping from 111.1111.111.111 into iptables.log.

cat /etc/rsyslog.conf
kern.* /var/log/iptables.log
systemctl restart rsyslog

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A INPUT -p icmp --icmp-type 8 --source -j LOG
iptables -A INPUT -p icmp --icmp-type 8 --source -j DROP
service iptables save
service iptables restart

Now to ping from to my vps.

1.iptables -A INPUT -p icmp --icmp-type 8 --source -j DROP can work.

PING ( 56(84) bytes of data. ^C --- 
ping statistics --- 23 packets transmitted, 0 received, 100% packet loss, time 22003ms

2.iptables -A INPUT -p icmp --icmp-type 8 --source -j LOG can't work

cat /var/log/iptables.log

Nothing in it,how to log the ping action from into /var/log/iptables.log ?

I got some material here:dmesg and iptables

dmesg reads from the kernel log buffer. Since iptables uses kernel logging
facility, that is where iptables log records appear in the first place.
There is no way you can make iptables log entries not appear in dmesg.

Does that means iptables log info can't be writtten into specified file?
Iptables log info can only be written into specified file this way:

dmesg > /var/log/iptables.log


dmesg >> /var/log/iptables.log


Is there another smart way to log automactically all info into /var/log/iptables.log?

2 Answers 2


Let's look at what your setup does:

iptables -N LOGGING

You create a new chain called LOGGING (which never gets any rules later on).

iptables -A INPUT -j LOGGING

All packets traversing the input chain jump to LOGGING. All rules after this rules will be ignored, as you never return from the LOGGING chain.

iptables -A INPUT -p icmp --icmp-type 8 --source -j LOG

This rule is inserted after the above jump, and never executed.

iptables -A INPUT -p icmp --icmp-type 8 --source -j DROP

After logging it, you want to drop the packet, meaning a reply won't be generated. Not sure if this is your intention.

So, don't do this. Clear all those rules with iptables -F INPUT, and then do instead just

iptables -A INPUT -p icmp --icmp-type 8 --source -j LOG

Nothing else. Now do a ping and see if it shows up in the syslog (it does on my system).

If you really need to, you can add a rule to drop the ping afterwards.


The type of vps matter.
My vps'type is openvz.
The log file will display by dmesg and not written automatically into custome log file,it is a bug in openvz.
To change my vps into a kvm vps, problem solved.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .