0

My requirements are to do extensive logging of various iptables rules that must be logged into a file other than Syslog or the Journal.

For some time have been using ulogd that enables setting up custom log files. However ulogd isn't supported in systemd on Fedora, that seems to indicate it is no longer a preferred option, and may be going the way of the dodo bird.

Wondering if there is a newer preferred option? (conntrack doesn't seem to provide full logging to a file.)

EDIT: Ok - some more details. Am using ipset that blocks and or logs traffic from particular countries. So for example, if there is outgoing traffic to particular countries, we need to know about it and investigate further. Having a large volume of logging information from iptables rules going into Syslog (and the new Journal used in Fedora) means that normal Syslog messages are swamped and important messages are being missed due to the volume of iptables logs. Hence we need to separate the normal Syslog messages from the high volume iptables logs

Improve this question
2
  • My requirements are to do extensive logging of various iptables rules You need to explain that better to give us a better understanding so we can give more accurate answers. At the moment, this is an XY Problem: meta.stackexchange.com/a/66378/205010
    – fukawi2
    Nov 12, 2013 at 2:56
  • Ok - some more details. Am using ipset that blocks and or logs traffic from particular countries. So for example, if there is outgoing traffic to particular countries, we need to know about it and investigate further. Having a large volume of logging information from iptables rules going into Syslog (and the new Journal used in Fedora) means that normal Syslog messages are swamped and important messages are being missed due to the volume of iptables logs. Hence we need to separate the normal Syslog messages from the high volume iptables logs.
    – Eureka Ikara
    Nov 12, 2013 at 5:39

2 Answers 2

Reset to default
1

use the following iptables directive after you run "man iptables"

-j LOG

Improve this answer
1
  • But the problem is that I have not been able to come up with a solution that doesn't log these messages to Syslog. I have been able to come up a solution that logs them to another file, but they also get logged to Syslog, which is what I need to avoid.
    – Eureka Ikara
    Nov 12, 2013 at 5:31
1

Perhaps the NFLOG target could be useful to you? I've never used it, but it sounds like it's what you're after?

This target provides logging of matching packets. When this target is set for a rule, the Linux kernel will pass the packet to the loaded logging backend to log the packet. This is usually used in combination with nfnetlink_log as log‐ ging backend, which will multicast the packet through a netlink socket to the specified multicast group. One or more userspace processes may subscribe to the group to receive the packets. Like LOG, this is a non-terminating target, i.e. rule traversal continues at the next rule.

(Emphasis added)

Improve this answer
1
  • Thanks for the suggestion. Actually in Fedora 19 ulogd now uses the NFLOG target as the ULOG target is deprecated. However, to add to my concerns about ulogd is that it causes lots of SELinux permission problems as there does not seem to be any up-to-date SELinux policy for it. Hence my thinking that maybe there is another solution I have not been able to find.
    – Eureka Ikara
    Nov 13, 2013 at 22:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .