Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is my iptables rule :

/sbin/iptables -I INPUT 1 -p tcp  -j LOG --log-level info --log-prefix " [ IPTABLES " --log-uid 

Here is the syslog.conf file :

#  /etc/syslog.conf Configuration file for syslogd.
#           For more information see syslog.conf(5)
#           manpage.

# First some standard logfiles.  Log by facility.

auth,authpriv.*      -/var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
#cron.*          -/var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log

# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#           -/var/log/
mail.warn           -/var/log/mail.warn
mail.err         -/var/log/mail.err

# Logging for INN news system
news.crit        -/var/log/news/news.crit
news.err         -/var/log/news/news.err
news.notice         -/var/log/news/news.notice

# Some `catch-all' logfiles.
    news.none;mail.none -/var/log/debug
    mail,news.none      -/var/log/messages

# Emergencies are sent to everybody logged in.
*.emerg             *

# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#   news.=crit;news.=err;news.=notice;\
#   *.=debug;*.=info;\
#   *.=notice;*.=warn   /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#    $ xconsole -file /dev/xconsole [...]
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
    *.=notice;*.=warn   -/var/log/xconsole.log

Here are some more details :

root@us4839:~# ps ax | grep syslog
11336 pts/1    S+     0:00 grep syslog
17910 ?        Ss     0:00 /sbin/syslogd
root@us4839:~# lsof /var/log/syslog
syslogd 17910 root    2w   REG   0,42 5508 57114744 /var/log/syslog

Am I doing anything wrong in this rule or there is something wrong somewhere else ?

share|improve this question
Is your syslog configured to write that log to any place? – Jenny D Feb 10 '14 at 9:06
Right now, NO. Though I will do it once I start seeing the logs in any of the log files. – Abhay PS Feb 10 '14 at 9:32
One thing I forgot to mention, this is OpenVZ VPS. I don't know if that makes a difference or not. – Abhay PS Feb 10 '14 at 9:34
Um. How would you expect to see any logs in any of the log files if syslog isn't configured to write the log? – Jenny D Feb 10 '14 at 9:34
should it not go to its default location ? Like /var/log/kern.log or /var/log/syslog. I have another server and it works there. Once its there in the default log files then I put a rule to filter them to another file. I guess filters are needed to separate logs in different file for better house keeping. – Abhay PS Feb 10 '14 at 9:41

I've had a similar problem a long time ago and it is (in part) related to the OpenVZ architecture.

Can you please confirm that:

  • the iptables rule syntax is correct
  • syslog & klogd are running (as far as I can remember klogd is required for openVZ to log kernel messages properly)

Does dmesg output contain the iptables log lines? If yes, then this is likely a syslog config issue. You could try to add a directive that's placing kernel.warn in a separate iptables.log file.

Edit Did you check the logfiles manually? If yes I'd grep for it e.g. with

grep -rl "MAC" /var/log/*   # should match, else use the interface name or IPTABLES as pattern

just to make sure...

share|improve this answer
klogd was required on those old systems to log any kernel messages whether OpenVZ or not. – Michael Hampton Mar 2 '14 at 16:18
Hi, justlovingIT, the iptables rules were right and worked well on other servers. This problem was only on VPS provided by a specific vendor. I tried the same rules on another VPS provied by another vendor and everything was working as expected. May be its the problem of virtualization architecture with that specific vendor. Anyways, I changed the provider. – Abhay PS Mar 3 '14 at 6:55
I'm also having no logging showing up. Its a vps, but I don't know if its OpenVZ or not. – chovy Feb 26 at 9:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.