Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've recently built a server and decided to use UFW for the first time. I was investigating a possible connection issue (turns out it was their end) but I noticed that the logs are full of entries saying that traffic was blocked on port 80 and port 443 - rather worrying for a web server. Checking ufw status confirms that all traffic on these ports is allowed - additionally, we haven't had anyone report problems connecting to the server.

I found this other question: UFW logs blocked request on open port, what am I missing? - it set my mind at ease, but I'd prefer to be able to not have these "FIN ACK" messages in my logs so I can discern legitimate entries more clearly.

Other than simply piping through grep, is it possible to selectively filter entry into the log from a UFW config setting?

share|improve this question
    
ufw status??? –  quanta Aug 30 '12 at 7:19
    
@quanta if you mean "what ports does ufw status say are blocked or open", I've edited my question to include more details. otherwise, could you perhaps be more detailed? –  HorusKol Aug 31 '12 at 13:25
    
I'm afraid that you can't do it with UFW. Are you considering using rsyslog/syslog-ng to filter the log? –  quanta Aug 31 '12 at 15:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.