There are many ways to log traffic for a web server. For example, if I want to log all incoming traffic, I can place the following line as the first rule appended to the
-A INPUT -j LOG --log-prefix "IPTABLES: " --log-level info
If I want to log all new connections, I can place the above rule after this rule:
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
Or if I want to log dropped connections, I can place the logging rule after accept rules and just before the drop rule, such as:
-A INPUT -p tcp --dport 22 -j ACCEPT -A INPUT -j LOG --log-prefix "IPTABLES: " --log-level info -A INPUT -j DROP
I find many of the example configurations found online log only some specific dropped connections, such as malformed packets or unwanted connections to SSH. If the connections have already been dropped specifically due to requirement, why do people still want to keep a log for it? Wouldn't logging all incoming connections (rate limited) be more useful than logging unwanted traffic?
Add Comment: I want to emphasize that I am asking this question with the purpose of network troubleshooting in mind.