I'm trying to log dropped packages to a custom file instead of /var/log/messages.

To achieve this, I have added these two lines at the end of my configuration file:

    -A INPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-INPUT-Dropped: " --log-level 4
    -A OUTPUT -m limit --limit 5/min -j LOG --log-prefix "IPTables-OUTPUT-Dropped: " --log-level 4

This works because I have configured the INPUT and OUTPUT chains as DROP by default, so if the package does not meet any previous rule, it will be logged and dropped.

However, I cannot log them to a custom file. They log successful to /var/log/messages, but I want them to be logged on /var/log/iptables.log. I've created the file /etc/rsyslog.d/iptables.conf with the following content:

    :msg, contains, "IPTables-INPUT-Dropped: " - /var/log/iptables.log
    & ~

then I restarted rsyslog, /etc/init.d/rsyslog restart and sent some packages I knew were going to be dropped.However, they are not logged in iptables.log, they are still being logged on /var/log/messages.

Which configuration is missing?

SOLVED The problem is that there shouldn't be an space between - and /

  • That should work (I use it). However, I have it in /etc/rsyslog.conf before other directives, so that the message gets dropped before anything else picks it up. Try that and kill -HUP `pidof rsyslogd`. Maybe loose the space at the end of the quoted string. – goldilocks Aug 31 '13 at 15:03
  • I've added the first line to rsyslog.conf but still it doesn't work – yzT Aug 31 '13 at 15:24

The problem is that there shouldn't be a space between - and /


This is a an alternative approach using ulogd. I would suggest this mechanism as it stops the kernel logging mechanism -m LOG uses (which has the grievous side effect of filling your dmesg log as well).

First you'll need ulogd, which you can get with an apt-get install ulogd. Edit your /etc/ulogd.conf, enable this module (by removing the # at the start of the line):


and change/add the section [LOGEMU]:


And then restart your ulogd with /etc/init.d/ulogd restart. Then instead of -j LOG use -j ULOG on your iptables rules. The ULOG module has no concept of --log-level so you can remove those options. It also uses --ulog-prefix instead of --log-prefix.

  • it does not work. – yzT Aug 31 '13 at 15:27
  • Did you restart the ulogd after adding the entry? (/etc/init.d/ulogd restart as root) – Drav Sloan Aug 31 '13 at 15:28
  • yeah, of course. Actually it is ulogd2 rather than ulogd – yzT Aug 31 '13 at 15:29
  • ah you need another step will add it to the answer. – Drav Sloan Aug 31 '13 at 15:31
  • Nop, it comes enabled by default. – yzT Aug 31 '13 at 15:36

This can be possible using :

To disable iptables logs in syslog , do modification as below in /etc/rsyslog.d/50-default.conf:

*.*;auth,authpriv.none;kern.*=!kern.warning             -/var/log/syslog

To log in separate file; append :

kern.=warning -/var/log/iptables.log

then once restart syslog or rsyslog and tail the logs

/etc/init.d/rsyslog restart

It's works in syslog and rsyslog also



& ~ is deprecated in the new rsyslog, you should use stop instead.


if ( $msg contains 'IN=' and $msg contains 'OUT=' ) 
then { 


        rotate 30

                service rsyslog rotate > /dev/null

Note i set the prefix to 10- to catch it before it reach the default rules (50-defaults).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.