How can I configure /etc/syslog.conf file in order to save log information about iptables in a specific file.

I want to save these information separately, so I can extract what I want easily and rapidly.

  • Are you using syslog.conf or rsyslog.conf? – slm Oct 18 '13 at 12:30


Take a look in the man page for iptables. It shows a target called LOG which can do what you want.


  1. Set the logging level for LOG to 4.

    # DROP everything and Log it
    iptables -A INPUT -j LOG --log-level 4
    iptables -A INPUT -j DROP
  2. Configure syslog.conf to write these messages to a separate file.

    # /etc/syslog.conf
    kern.warning     /var/log/iptables.log
  3. Restart syslogd.


    $ sudo /etc/init.d/sysklogd restart


    $ sudo /etc/init.d/syslog restart

NOTE: This method of logging is called fixed priorities. They are either numbers or names (1,2,3,4,..) or (DEBUG, WARN, INFO, etc.).


If by chance you're using rsyslog, you can create a property based filter like so:

# /etc/rsyslog.conf
:msg, contains, "NETFILTER"       /var/log/iptables.log
:msg, contains, "NETFILTER"     ~

Then add thils switch to your iptables rules that you want to log:

–log-prefix NETFILTER

As an alternative you could also log the messages using this type of property filter:

:msg, startswith, "iptables: " -/var/log/iptables.log
& ~
:msg, regex, "^\[ *[0-9]*\.[0-9]*\] iptables: " -/var/log/iptables.log
& ~

NOTE: This 2nd method doesn't require any changes to iptables.


  • In this case, inforamtion will be saved in /var/log/iptables and also in /var/log/messages. I want only one copy from this data in iptables.log – Abid Oct 18 '13 at 7:26
  • 1
    I added my own answer to also cover Abid's question, plus the missing logrotate config. the "stop" or "& ~" prevents the messages from continuing down rsyslog's rules to get to /var/log/messages also. – Peter Jan 9 '15 at 14:53

This assumes your firewall already makes logs, as any sane firewall should. For some examples, it requires an identifiable message, such as "NETFILTER" in slm's example.

make a file in rsyslog.d

vim /etc/rsyslog.d/10-firewall.conf

This works in CentOS 7. I don't know how to verify that it came from the firewall other than looking for IN and OUT... CentOS is weird. Don't use this unless the next version doesn't work.

# into separate file and stop their further processing
if  ($msg contains 'IN=' and $msg contains 'OUT=') \
then {
    & ~

This works in CentOS 7 and checks for the message content too (replace "Shorewall" with whatever you have in your -j LOG rule's message):

# into separate file and stop their further processing
if  ($msg contains 'Shorewall') and \
    ($msg contains 'IN=' and $msg contains 'OUT=') \
then {
    & ~

This works in others (Ubuntu, Debian, openSUSE). And this is the best way to do it. No searching for strings in the message:

# into separate file and stop their further processing
if  ($syslogfacility-text == 'kern') and \\
($msg contains 'IN=' and $msg contains 'OUT=') \\
then    -/var/log/firewall
    &   ~

And here is what a default openSUSE machine has (which I think every distro should have and is missing) (difference seems to be only "stop" instead of "& ~"; not all systems support both syntaxes):

if  ($syslogfacility-text == 'kern') and \
    ($msg contains 'IN=' and $msg contains 'OUT=') \
then {

And for all of the above, don't forget a logrotate.d file too:

vim /etc/logrotate.d/firewall


/var/log/firewall {
    rotate 7
    size 500k
        # before using this, run the command yourself to make sure 
        # it is right... the daemon name may vary
        /usr/bin/killall -HUP rsyslogd

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.