I have ubuntu and I want to know where can I find the log file of iptables?
I find out /var/log/messages, but I am not sure this is a correct log file or not.

And I also want to know when this log file is changed? I add one rule to prevent my machine to respond to ping message but when I ping my machine I didn't see any changes to /var/log/messages

2 Answers 2


IPTables doesn't log unless you add a rule to add a log entry. This is typically done with the -j LOG destination. The log entry is sent to the kernel log, and your syslog daemon determines where kernel log entries go, which seems to be /var/log/messages in your case.

If you want to block pings from a certain host (a fictional 123.456.789.10 for example), and log all those packets, run:

iptables -A INPUT -p icmp --icmp-type 8 --source 123.456.789.10 -j LOG
iptables -A INPUT -p icmp --icmp-type 8 --source 123.456.789.10 -j DROP
  • 1
    Do note, however, that logging every single packet marked for dropping is liable to fill up your log filesystem really, really fast... Commented Mar 9, 2011 at 14:28
  • Agreed, that's why I only logged for a particular source IP.
    – jsbillings
    Commented Mar 9, 2011 at 14:49
  • 2
    Adding -m limit --limit 4/min --limit-burst 10 also helps.
    – stribika
    Commented Mar 9, 2011 at 18:02
  • I add this rule in my iptables "sudo iptables -A INPUT -p icmp -j LOG" but when I ping my host to entry added to /var/log/messages
    – Am1rr3zA
    Commented Mar 10, 2011 at 12:03
  • @Am1rr3zA: what's the question? I don't understand your last comment. If you're using the syntax -A INPUT, that appends to the end of the INPUT table, so any rule that already accepts or rejects the packet would catch it.
    – jsbillings
    Commented Mar 10, 2011 at 13:34

Because it can easily fill up your logs, the default is to not log. Add a jump to the LOG target, which will log to the kernel log (which you can see with dmesg or at wherever syslog is configured to write that for your distro). In your LOG-target rule, you can set --log-level and --log-prefix to help organize the messages and keep them separate from other kernel messages.

LOG is a "non-terminating target", so rule traversal will continue on to the next rule — you can basically add logging right above your existing rules without affecting them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .