What is the right way to log iptables as of kernel 3.9.0?

I can no longer append a logging rule such as:

# iptables --new-chain droplog
# iptables --append droplog --jump LOG --log-level info
iptables: No chain/target/match by that name.

I used to enable IP tables logging support by checking this out:

IP: Netfilter Configuration  --->
 <*> IP tables support (required for filtering/masq/NAT)
    <*> LOG target support

But this option is missing from kernel 3.9.0, and seems to have been replaced by CONFIG_NETFILTER_NETLINK_LOG.

1 Answer 1


The symbol that enables the LOG target has changed to NETFILTER_XT_TARGET_LOG. Its location has also moved to:

Networking support
 Networking options
  Network packet filtering framework (Netfilter)
   Core Netfilter Configuration
    Netfilter Xtables support (required for ip_tables)
     LOG target support

If we could just track how kernel symbols change over time, that would be great.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .