27

I've successfully set up a WireGuard VPN on my Debian 10 server. It was incredibly straight forward compared to the setup of OpenVPN, and it's working fine.

However, I can't see any logs beyond those from journalctl -u [email protected]. I'd like to know, for example, when there are failed authentication attempts. Is there a way to monitor that? e.g. with openvpn I could use fail2ban based on auth attempts.

3 Answers 3

35

Assuming you are running a kernel which supports dynamic debugging, you can enable debug logs by executing:

# modprobe wireguard 
# echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control

The logs can than be consumed via dmesg or journalctl. With dmesg, just use following command:

$ dmesg -wH

(-H, --human enables user-friendly features like colors, relative time)

(-w, --follow)

Also on systems with systemd you can use:

$ journalctl -kf
7
  • Alas I'm on Debian buster 4.19 kernel. Thanks though. Jun 7, 2020 at 13:50
  • @artfulrobot The newer kernel version could be installed easily via the buster-backports channel if you don't mind a reboot.
    – Arnie97
    Aug 6, 2020 at 7:04
  • 4
    For CONFIG_DYNAMIC_DEBUG kernels, any settings given at boot-time (or enabled by -DDEBUG flag during compilation) can be disabled later via the sysfs interface if the debug messages are no longer needed: echo "module module_name -p" > <debugfs>/dynamic_debug/control. You can read the docs here Mar 8, 2021 at 10:01
  • 3
    worth mentioning that in minimal setups or containers you may need to enable the debugfs via sudo mount -t debugfs none /sys/kernel/debug/
    – Treviño
    Dec 3, 2021 at 13:27
  • 1
    @Winand Sorry, don't know why I thought that a 5.6 kernel would be necessary, I removed that section. Thanks for pointing that out. Mar 11 at 23:09
3

To automatically activate wireguard's dynamic debug logging directly at boot, have the wireguard kernel module

  • load at boot time
  • with the dynamic debug option
# automatically modprobe wireguard during boot:
echo "wireguard" | sudo tee /etc/modules-load.d/wireguard.conf

# automatically activate dynamic_debug for wireguard during boot:
echo "options wireguard dyndbg=+p" | sudo tee /etc/modprobe.d/wireguard.conf

(Reference: Debug Messages at Module Initialization Time from kernel.org documentation)

The wireguard-specific log entries can then be followed/monitored with any of the following commands:

sudo journalctl -x -f -g wireguard*

sudo dmesg -wH --color=always | grep -i wireguard
2

My version of logging users, script in crontab every 3 minutes. If inactivity less then 180 seconds, nothing doing, else appending to a log file.

wg show all dump | grep 10.0 | awk 'BEGIN {}; {if (systime()-$6 <180 ) print strftime("%m-%d-%Y %H:%M:%S", systime()),$5, $4, (systime()-$6) "sec" } ; END {}' >> /var/log/wg.log

Note: Searching for 10.0 in the output, because that is what IP addresses in my private network start with.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .