I want to create a file
iptables.log that logs all DROP's and intrusion attempts. Here is what I did, step by step:
1) In my iptables rules file, I put the following:
-A INPUT -j LOG --log-level 4 --log-ip-options --log-prefix "iptables: " -P INPUT DROP -P OUTPUT DROP -P FORWARD DROP # and then the other rules to open up SSH
Then I use
iptables-restore to apply changes.
2) I created a file
/etc/rsyslog.d/, with this rule inside:
:msg, startswith, "iptables: " -/var/log/iptables.log & ~
/etc/rsyslog.d/50-default.conf, I put this:
#iptables kern.warning /var/log/iptables.log
4) I restart
But it doesn't seem to be sufficient to achieve my goal. What else is needed to do?
Also, should I make a rule for
-A OUTPUT -j LOG as well or is it useless?