28

I've successfully set up a WireGuard VPN on my Debian 10 server. It was incredibly straight forward compared to the setup of OpenVPN, and it's working fine.

However, I can't see any logs beyond those from journalctl -u [email protected]. I'd like to know, for example, when there are failed authentication attempts. Is there a way to monitor that? e.g. with openvpn I could use fail2ban based on auth attempts.

3 Answers 3

38

Assuming you are running a kernel which supports dynamic debugging, you can enable debug logs by executing:

# modprobe wireguard 
# echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control

The logs can than be consumed via dmesg or journalctl. With dmesg, just use following command:

$ dmesg -wH

(-H, --human enables user-friendly features like colors, relative time)

(-w, --follow)

Also on systems with systemd you can use:

$ journalctl -kf
7
  • Alas I'm on Debian buster 4.19 kernel. Thanks though. Commented Jun 7, 2020 at 13:50
  • 1
    How do you reverse +p thing once I'm done? I'm trying to debug a WireGuard client issue, how do I point journalctl to consume the appropriate log?
    – Oxwivi
    Commented Mar 8, 2021 at 7:53
  • 5
    For CONFIG_DYNAMIC_DEBUG kernels, any settings given at boot-time (or enabled by -DDEBUG flag during compilation) can be disabled later via the sysfs interface if the debug messages are no longer needed: echo "module module_name -p" > <debugfs>/dynamic_debug/control. You can read the docs here Commented Mar 8, 2021 at 10:01
  • 3
    worth mentioning that in minimal setups or containers you may need to enable the debugfs via sudo mount -t debugfs none /sys/kernel/debug/
    – Treviño
    Commented Dec 3, 2021 at 13:27
  • 1
    @Winand Sorry, don't know why I thought that a 5.6 kernel would be necessary, I removed that section. Thanks for pointing that out. Commented Mar 11, 2023 at 23:09
3

To automatically activate wireguard's dynamic debug logging directly at boot, have the wireguard kernel module

  • load at boot time
  • with the dynamic debug option
# automatically modprobe wireguard during boot:
echo "wireguard" | sudo tee /etc/modules-load.d/wireguard.conf

# automatically activate dynamic_debug for wireguard during boot:
echo "options wireguard dyndbg=+p" | sudo tee /etc/modprobe.d/wireguard.conf

(Reference: Debug Messages at Module Initialization Time from kernel.org documentation)

The wireguard-specific log entries can then be followed/monitored with any of the following commands:

sudo journalctl -x -f -g wireguard*

sudo dmesg -wH --color=always | grep -i wireguard
2

My version of logging users, script in crontab every 3 minutes. If inactivity less then 180 seconds, nothing doing, else appending to a log file.

wg show all dump | grep 10.0 | awk 'BEGIN {}; {if (systime()-$6 <180 ) print strftime("%m-%d-%Y %H:%M:%S", systime()),$5, $4, (systime()-$6) "sec" } ; END {}' >> /var/log/wg.log

Note: Searching for 10.0 in the output, because that is what IP addresses in my private network start with.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .