Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Ubuntu server where I am blocking some IPs with ufw. I enabled logging, but I don't know where to find the logs. Where might the logs be or why might ufw not be logging?

share|improve this question
    
Google is your friend askubuntu.com/questions/113439/… –  Iain Jun 19 '13 at 5:49

1 Answer 1

up vote 3 down vote accepted

Perform sudo ufw status verbose to see if you're even logging in the first place. If you're not, perform sudo ufw logging on if it isn't. If it is logging, check /var/log/ for files starting with ufw. For example, sudo ls /var/log/ufw*

If you are logging, but there are no /var/log/ufw* files, check to see if rsyslog is running: sudo service rsyslog status. If rsyslog is running, ufw is logging, and there are still no logs files, search through common log files for any mention of UFW. For example: grep -i ufw /var/log/syslog and grep -i ufw /var/log/messages as well as grep -i ufw /var/log/kern.log.

If you find a ton of ufw messages in the syslog, messages, and kern.log file, then rsyslog might need to be told to log all UFW messages to a separate file. Add a line to the top of /etc/rsyslog.d/50-default.conf that says the following two lines:

:msg, contains, “UFW” -/var/log/ufw.log
& ~

And you should then have a ufw.log file that contains all ufw messages!

NOTE:

Do I need to tell you to check the 50-default.conf file for pre-existing references to ufw? Do I need to tell you to backup the 50-default.conf file to 50-default.conf.date before making any changes? No... no I don't. You know that already.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.