Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

OS: Ubuntu 10.04 Logging daemon: rsyslog

For some reason i'm not getting any iptables logs, even thought i don't look through them very often i'd still like to get it working for the sake of it working XD

Here is my /etc/ryslog.d/iptables.conf

:msg, contains, "[IPTABLES]" -/var/log/iptables.log
& ~

My iptables logging prefix is "[IPTABLES]" followed by whatever else (example [IPTABLES] Denied xyz)

the /var/log/iptables.log file is being created, however its not getting any entries. I can see the logging entries in dmesg but not in syslog or messages.

Whats going on?

EDIT: My iptables logging rules:

# logging limit
LoggingLimit=5/min
LoggingPrefix=IPTABLES

# Logging chain
iptables -N LOG_REJECT
iptables -A LOG_REJECT -j LOG

# join INPUT to LOG_REJECT
iptables -A INPUT -j LOG_REJECT

# logging
iptables -A LOG_REJECT -p tcp -m limit --limit $LoggingLimit -j LOG --log-prefix "$LoggingPrefix Denied TCP: " #--log-level 7
iptables -A LOG_REJECT -p udp -m limit --limit $LoggingLimit -j LOG --log-prefix "$LoggingPrefix Denied UDP: " #--log-level 7
iptables -A LOG_REJECT -p icmp -m limit --limit $LoggingLimit -j LOG --log-prefix "$LoggingPrefix Denied ICMP: " #--log-level 7

Update: I found a thread that has the same symptoms as i do, apparently is a kernel bug. I am using a VPS so could anyone point me on how to upgrade my kernel or apply a workaround? I couldn't find a 2.6.34 kernel listed in apt-cache.

Thread: http://www.linode.com/forums/viewtopic.php?t=5533

share|improve this question

5 Answers 5

Can you show what the entries in dmesg look like?

share|improve this answer
    
[IPTABLES] Denied TCP: IN=eth0 OUT= MAC=asdf SRC=asdf DST=asdf LEN=52 TOS=0x00 PREC=0x00 TTL=116 ID=32775 DF PROTO=TCP SPT=25 DPT=48615 WINDOW=65534 RES=0x00 ACK URGP=0 –  vps_newcomer Jul 13 '10 at 9:16
    
that's from running "dmesg" and copy pasting one of the entries, but there aren't any entires in /var/log/dmesg (i dunno if they are related). –  vps_newcomer Jul 13 '10 at 9:20

While this is not a direct answer to your question, I suggest you to not mix iptables logs with system logs.

Consider ulogd and -j ULOG instead of -j LOG in your ruleset.

share|improve this answer
    
I installed ulog then changed ip tables to log to ULOG with ulog--prefix instead and it didn't get any logs either, but i'm still seeing them in dmesg! WTF >_<! –  vps_newcomer Jul 14 '10 at 0:29
    
ulogd also has his own config file, did you tune it to suit your needs? –  halp Jul 14 '10 at 23:39

Xmmm.

Propably it doesn't match the regexpr. You could write something like

:msg, contains, "[IPTABLES]" CONSOLE where CONSOLE is the result of tty command. That way, if anything matches with your regexpr, it will be printed to your console {Just for debugging}.

If it doesn't print anything, propably you don't have a match. In this case, either add '[' before '[' to handle it as an escape character, or just remove '[' , ']'

share|improve this answer
    
I removed the '[' and ']' all together from the iptables logging prefix and tried using different regex rules but nothing worked :( –  vps_newcomer Jul 14 '10 at 0:28
    
ok. Let's try something else. try to send a dummy messages to rsyslog via logger. You can do it like .... logger "[IPTABLES] Denied TCP: IN=eth0 OUT= ...." if it won't work, propably iptables doesn't send logs to rsyslog {Did you tried the thing with console for debbuging ?} –  Nikolaidis Fotis Jul 14 '10 at 10:35
    
Also try "modprobe ipt_LOG" and a desperate move. Change loggingprefix from iptables to rsyslog, although it won't make any change ! –  Nikolaidis Fotis Jul 14 '10 at 10:39
    
Thanks for the suggestions but i have it working after i upgraded rsyslog to a newer version :) –  vps_newcomer Jul 15 '10 at 0:08
up vote 0 down vote accepted

Upgraded rsyslog and now everything is working!

/etc/init.d/rsyslog stop 
/etc/init.d/rsyslog.dpkg-new stop 

cd /usr/src 
wget http://www.rsyslog.com/Downloads-req-getit-lid-197.phtml 
tar zxvf rsyslog-5.4.0.tar.gz. 
cd rsyslog-5.4.0 
./configure 
make 
make install 

mv /etc/rsyslog.conf /etc/rsyslog.conf.original 
cp /usr/src/rsyslog.conf /etc/rsyslog.conf 

reboot
share|improve this answer

Instead of "[IPTABLES]", try using "IPTABLES" only. It may work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.