0

OS: Ubuntu 10.04 Logging daemon: rsyslog

For some reason i'm not getting any iptables logs, even thought i don't look through them very often i'd still like to get it working for the sake of it working XD

Here is my /etc/ryslog.d/iptables.conf

:msg, contains, "[IPTABLES]" -/var/log/iptables.log
& ~

My iptables logging prefix is "[IPTABLES]" followed by whatever else (example [IPTABLES] Denied xyz)

the /var/log/iptables.log file is being created, however its not getting any entries. I can see the logging entries in dmesg but not in syslog or messages.

Whats going on?

EDIT: My iptables logging rules:

# logging limit
LoggingLimit=5/min
LoggingPrefix=IPTABLES

# Logging chain
iptables -N LOG_REJECT
iptables -A LOG_REJECT -j LOG

# join INPUT to LOG_REJECT
iptables -A INPUT -j LOG_REJECT

# logging
iptables -A LOG_REJECT -p tcp -m limit --limit $LoggingLimit -j LOG --log-prefix "$LoggingPrefix Denied TCP: " #--log-level 7
iptables -A LOG_REJECT -p udp -m limit --limit $LoggingLimit -j LOG --log-prefix "$LoggingPrefix Denied UDP: " #--log-level 7
iptables -A LOG_REJECT -p icmp -m limit --limit $LoggingLimit -j LOG --log-prefix "$LoggingPrefix Denied ICMP: " #--log-level 7

Update: I found a thread that has the same symptoms as i do, apparently is a kernel bug. I am using a VPS so could anyone point me on how to upgrade my kernel or apply a workaround? I couldn't find a 2.6.34 kernel listed in apt-cache.

Thread: http://www.linode.com/forums/viewtopic.php?t=5533

Improve this question

5 Answers 5

Reset to default
1

Instead of "[IPTABLES]", try using "IPTABLES" only. It may work.

Improve this answer
0

Can you show what the entries in dmesg look like?

Improve this answer
2
  • [IPTABLES] Denied TCP: IN=eth0 OUT= MAC=asdf SRC=asdf DST=asdf LEN=52 TOS=0x00 PREC=0x00 TTL=116 ID=32775 DF PROTO=TCP SPT=25 DPT=48615 WINDOW=65534 RES=0x00 ACK URGP=0
    – vps_newcomer
    Jul 13, 2010 at 9:16
  • that's from running "dmesg" and copy pasting one of the entries, but there aren't any entires in /var/log/dmesg (i dunno if they are related).
    – vps_newcomer
    Jul 13, 2010 at 9:20
0

While this is not a direct answer to your question, I suggest you to not mix iptables logs with system logs.

Consider ulogd and -j ULOG instead of -j LOG in your ruleset.

Improve this answer
3
  • I installed ulog then changed ip tables to log to ULOG with ulog--prefix instead and it didn't get any logs either, but i'm still seeing them in dmesg! WTF >_<!
    – vps_newcomer
    Jul 14, 2010 at 0:29
  • ulogd also has his own config file, did you tune it to suit your needs?
    – halp
    Jul 14, 2010 at 23:39
  • for ulogd use something like -j NFLOG --nflog-prefix "DROP INPUT " & for configuration see /etc/ulogd.conf - in Debian by default the logs will appear under /etc/ulogd & the daemon is ulogd2. In an OpenVZ container you can sometimes be missing iptables logs depending on how the host node is configured
    – Stuart Cardall
    Dec 28, 2018 at 13:36
0

Xmmm.

Propably it doesn't match the regexpr. You could write something like

:msg, contains, "[IPTABLES]" CONSOLE where CONSOLE is the result of tty command. That way, if anything matches with your regexpr, it will be printed to your console {Just for debugging}.

If it doesn't print anything, propably you don't have a match. In this case, either add '[' before '[' to handle it as an escape character, or just remove '[' , ']'

Improve this answer
4
  • I removed the '[' and ']' all together from the iptables logging prefix and tried using different regex rules but nothing worked :(
    – vps_newcomer
    Jul 14, 2010 at 0:28
  • ok. Let's try something else. try to send a dummy messages to rsyslog via logger. You can do it like .... logger "[IPTABLES] Denied TCP: IN=eth0 OUT= ...." if it won't work, propably iptables doesn't send logs to rsyslog {Did you tried the thing with console for debbuging ?}
    – Nikolaidis Fotis
    Jul 14, 2010 at 10:35
  • Also try "modprobe ipt_LOG" and a desperate move. Change loggingprefix from iptables to rsyslog, although it won't make any change !
    – Nikolaidis Fotis
    Jul 14, 2010 at 10:39
  • Thanks for the suggestions but i have it working after i upgraded rsyslog to a newer version :)
    – vps_newcomer
    Jul 15, 2010 at 0:08
0

Upgraded rsyslog and now everything is working!

/etc/init.d/rsyslog stop 
/etc/init.d/rsyslog.dpkg-new stop 

cd /usr/src 
wget http://www.rsyslog.com/Downloads-req-getit-lid-197.phtml 
tar zxvf rsyslog-5.4.0.tar.gz. 
cd rsyslog-5.4.0 
./configure 
make 
make install 

mv /etc/rsyslog.conf /etc/rsyslog.conf.original 
cp /usr/src/rsyslog.conf /etc/rsyslog.conf 

reboot
Improve this answer

You must log in to answer this question.