I have IPTables rules set on a Linux device. I have a particular rule to drop the packets, and I wish to log the packets only if they're dropped by that specific rule, and not by the other rules.
Hence not written out to the syslog.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
You could use
rsyslog and set a custom
--log-prefix on this specific rule when you're setting it up. This would allow you to setup a
rsyslog rule to route any messages with this custom prefix to a individual log file.
This tutorial titled: Change the IPTables log file, shows the exact methodology. In general you'll setup your iptables rule like so:
$ sudo iptables -A INPUT -p tcp --dport 22 --syn -j LOG --log-prefix "iptables: "
And then create a corresponding
rsyslog rule to log messages with this prefix:
# /etc/rsyslog.d/10-iptables.conf :msg, contains, "iptables: " -/var/log/iptables.log & ~