Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to create a file iptables.log that logs all DROP's and intrusion attempts. Here is what I did, step by step:

1) In my iptables rules file, I put the following:

-A INPUT -j LOG --log-level 4 --log-ip-options --log-prefix "iptables: "

-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP

# and then the other rules to open up SSH

Then I use iptables-restore to apply changes.

2) I created a file iptables.conf within /etc/rsyslog.d/, with this rule inside:

:msg, startswith, "iptables: " -/var/log/iptables.log
& ~

3) Within /etc/rsyslog.d/50-default.conf, I put this:

#iptables
kern.warning /var/log/iptables.log

4) I restart rsyslog daemon.

But it doesn't seem to be sufficient to achieve my goal. What else is needed to do?

Also, should I make a rule for -A OUTPUT -j LOG as well or is it useless?

share|improve this question
    
Well, did it work? Give it a try and post the results back here if it doesn't work. –  Magellan Sep 24 '12 at 3:29
    
Also can you post the full command for iptables so we can help you find the syntax error. –  golja Sep 24 '12 at 3:44
    
Hi, Thanks for your message. I edited my post. I have solved the syntax error but I still can't achieve my goal. –  anthony01 Sep 24 '12 at 5:05
add comment

2 Answers

up vote 2 down vote accepted

It's not an immediate item, but more of a 'clean up' aspect that's simply a good habit.

I recommend configuring log rotation so that you don't fill up your logging partition with your new log file. Most services drop a config file in /etc/logrotate.d/. And the packet logging can be QUITE chatty.

Since this is a new log file, you'll have to add it to an existing one such as your /etc/logrotate.d/rsyslog.conf.

share|improve this answer
    
Hi, thanks for your response. But in rsyslog.conf, this line $IncludeConfig /etc/rsyslog.d/*.conf makes sure my newly created iptables.conf is taken into account. Wouldn't that be sufficient? Thanks –  anthony01 Sep 24 '12 at 3:32
    
Automatically taken into account? I wouldn't assume so without some trigger for those services to reload the config files. A 'kill -SIGHUP $(pidof rsyslogd)' would probably suffice though. Otherwise you'll need to restart the rsyslogd service. –  Magellan Sep 24 '12 at 3:36
add comment

It worked for us (Debian 6) just including the additional rule in /etc/rsyslog.d/ and living untouched the rsyslog.conf file.

We confirmed that directory rules get executed "before" the core rsyslog.conf and the "& ~" makes matching entries stop searching for following rules.

This is, a file within /etc/rsyslog.d/ with

:msg, startswith, "Firewall: " -/var/log/firewall.log
& ~

did the job as having also an entry for kern.warning I understand would duplicate rules.

In our case iptables rules are created by CSF firewall so perhaps the problem is there. Firewall rules look like

19    2140  113K LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *TCP_IN Blocked* ' 
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.