Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using ubuntu 10.10. with iptables! I want to log my firewall drops in the file /var/log/firewall and NOT in any other logfile.

So I added the following line to my file: /etc/rsyslog.d/50-default.conf:

#iptables Log
kern.warning    /var/log/firewall.log

This way my drops and logs from iptables are logging into the right file!

Now i dont know what to add to not log the drops in the other files.. At this time it write every drop in /var/log/messages /var/log/kern.log and /var/log/syslog

Heeeelp :)

I found this one : but it doesnt work.. Maybe because its Rsyslogd in Ubuntu 10.10?


share|improve this question
up vote 4 down vote accepted

Use a discard action after the iptables log, but before the other logs.

kern.warning   /var/log/firewall.log
kern.warning   ~
*.*            /var/log/messages
share|improve this answer
Thank you very much! – Fake4d Oct 14 '10 at 6:08
What does ~ mean? (the rsyslog manual is a little vague). – Stefan Lasiewski Oct 20 '10 at 0:09
@Stefan: rsyslog.conf(5) man page, ACTIONS section, Discard subsection. – Ignacio Vazquez-Abrams Oct 20 '10 at 0:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.