log-all should be hyphenated and after
allow. The correct command is
sudo ufw allow log-all proto tcp from x.x.x.x to any port 22
x.x.x.x with the intended IP.
The syntax is documented on the man page.
ufw [--dry-run] [rule] [delete] [insert NUM] [prepend] allow|deny|reject|limit [in|out [on
INTERFACE]] [log|log-all] [proto PROTOCOL] [from ADDRESS [port PORT | app APPNAME ]] [to
ADDRESS [port PORT | app APPNAME ]] [comment COMMENT]
A couple paragraphs at the very end of the section RULE SYNTAX explain how this works and provide a simpler example:
ufw supports per rule logging. By default, no logging is performed when a packet matches a rule. Specifying log will log
all new connections matching the rule, and log-all will log all packets matching the rule. For example, to allow and log
all new ssh connections, use:
ufw allow log 22/tcp
See LOGGING for more information on logging.
Most keywords are optional, but the order is very rigid: the word
log-all must go after the interface (
on wlo0, etc.). If the interface is not present, it must go after the action:
log keyword anywhere else will return the error
Option log not allowed here.
How to update your rule
If you want to keep the rule but disable the logging, simply write the command again without the
sudo ufw allow proto tcp from x.x.x.x to any port 22
ufw will recognise this and respond with `Rule updated` instead of `Skipping adding existing rule`.
This also works to add or remove comments to your rules:
sudo ufw allow log-all proto tcp from x.x.x.x to any port 22 comment 'incoming SSH'
Optional: logging need not be per-rule
You can also check the LOGGING section to log more information, for all rules (allowed packets as well):
sudo ufw logging off
sudo ufw logging low
sudo ufw logging medium
sudo ufw logging high
sudo ufw logging full
but the man page gently discourages setting the logging level over the default (
Unsolicited tips for your configuration
ufw has a separate syntax for default policies (that is, any connection which is not specifically mentioned in your ruleset). Your ruleset will be easier to understand and maintain if you replace your explicit "deny in from anywhere to anywhere" rule like this:
sudo ufw default deny incoming
sudo ufw delete deny from any
As long as the logging level is above low, ufw will log any blocked traffic. You can check the result with
sudo ufw status verbose.
The Ubuntu wiki has pages on security, and you can check their recommended ufw configuration.