Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is my iptables rule :

/sbin/iptables -I INPUT 1 -p tcp  -j LOG --log-level info --log-prefix " [ IPTABLES " --log-uid 

Here is the syslog.conf file :

#  /etc/syslog.conf Configuration file for syslogd.
#
#           For more information see syslog.conf(5)
#           manpage.

#
# First some standard logfiles.  Log by facility.
#

auth,authpriv.*      -/var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
#cron.*          -/var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info           -/var/log/mail.info
mail.warn           -/var/log/mail.warn
mail.err         -/var/log/mail.err

# Logging for INN news system
#
news.crit        -/var/log/news/news.crit
news.err         -/var/log/news/news.err
news.notice         -/var/log/news/news.notice

#
# Some `catch-all' logfiles.
#
*.=debug;\
    auth,authpriv.none;\
    news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none      -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg             *

#
# I like to have messages displayed on the console, but only on a virtual
# console I usually leave idle.
#
#daemon,mail.*;\
#   news.=crit;news.=err;news.=notice;\
#   *.=debug;*.=info;\
#   *.=notice;*.=warn   /dev/tty8

# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
# you must invoke `xconsole' with the `-file' option:
#
#    $ xconsole -file /dev/xconsole [...]
#
# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
#      busy site..
#
daemon.*;mail.*;\
    news.err;\
    *.=debug;*.=info;\
    *.=notice;*.=warn   -/var/log/xconsole.log

Here are some more details :

root@us4839:~# ps ax | grep syslog
11336 pts/1    S+     0:00 grep syslog
17910 ?        Ss     0:00 /sbin/syslogd
root@us4839:~#
root@us4839:~#
root@us4839:~# lsof /var/log/syslog
COMMAND   PID USER   FD   TYPE DEVICE SIZE     NODE NAME
syslogd 17910 root    2w   REG   0,42 5508 57114744 /var/log/syslog
root@us4839:~#

Am I doing anything wrong in this rule or there is something wrong somewhere else ?

share|improve this question
    
Is your syslog configured to write that log to any place? –  Jenny D Feb 10 at 9:06
    
Right now, NO. Though I will do it once I start seeing the logs in any of the log files. –  Abhay PS Feb 10 at 9:32
    
One thing I forgot to mention, this is OpenVZ VPS. I don't know if that makes a difference or not. –  Abhay PS Feb 10 at 9:34
2  
Um. How would you expect to see any logs in any of the log files if syslog isn't configured to write the log? –  Jenny D Feb 10 at 9:34
    
should it not go to its default location ? Like /var/log/kern.log or /var/log/syslog. I have another server and it works there. Once its there in the default log files then I put a rule to filter them to another file. I guess filters are needed to separate logs in different file for better house keeping. –  Abhay PS Feb 10 at 9:41

1 Answer 1

I've had a similar problem a long time ago and it is (in part) related to the OpenVZ architecture.

Can you please confirm that:

  • the iptables rule syntax is correct
  • syslog & klogd are running (as far as I can remember klogd is required for openVZ to log kernel messages properly)

Does dmesg output contain the iptables log lines? If yes, then this is likely a syslog config issue. You could try to add a directive that's placing kernel.warn in a separate iptables.log file.

Edit Did you check the logfiles manually? If yes I'd grep for it e.g. with

grep -rl "MAC" /var/log/*   # should match, else use the interface name or IPTABLES as pattern

just to make sure...

share|improve this answer
    
klogd was required on those old systems to log any kernel messages whether OpenVZ or not. –  Michael Hampton Mar 2 at 16:18
    
Hi, justlovingIT, the iptables rules were right and worked well on other servers. This problem was only on VPS provided by a specific vendor. I tried the same rules on another VPS provied by another vendor and everything was working as expected. May be its the problem of virtualization architecture with that specific vendor. Anyways, I changed the provider. –  Abhay PS Mar 3 at 6:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.