Logging for IPTABLES

logo · 10-08-2004, 01:58 PM

Hello all.
I have a question. I want to log specific internet traffic using the IPTABLES firewall.
I found that I can define -j LOG as target, but I can't find where the logs are located. Can anyone tell where they are and what are the log files named, or suggest another way of logging specified traffic(program, command)?
Thaks a lot.

homey · 10-08-2004, 04:51 PM

Hopefully, you don't log everything good or bad. I've never had the misfortune of it getting used but I'm pretty sure it gets saved to /var/log/messages. Maybe you could test it with a normal event.

mritch · 10-09-2004, 07:21 AM

i suggest to use
--log-level info (won't disturb your console)
--log-prefix "something" (maybe the rule name for better understanding what caused the drop/log - will show up in messages)

if you want to log a lot of traffic i'd suggest to use somthing like "-m limit --limit 6/m --limit-bursts 3", so the logs won't get too full.

sl mritch.

bennethos · 10-11-2004, 07:15 AM

I also got question bout' iptables, when i do iptables -L

I put in my input chain, first rule, test rule following :

LOG icmp -- anywhere anywhere icmp echo-reply LOG level warning

can anyone explain me what LOG level warning means ??? what about the warning ?
I also noticed he doesn't Log anything, not in syslog not in messages not in kern.log ....

thx !!!

mritch · 10-11-2004, 09:23 AM

would be the priority the logentry will get:
--log-level warning
..have a look into "man syslog" to get an overview about the different priorities...

sl mritch.