I am working with some CentOS rules and would like to be able to log the dropped items from iptables out to a separate file. What is the best way to setup CentOS to log dropped iptables matches to a log file under /var/log that is not equal to the messages file.

If it matters, I am using both CentOS 5.5 and newer as well as CentOS 6.x.

  • I am not sure if this could be done by extending or changing the configuration of rsyslog or not? If so, I would be interested in seeing some examples or how to configure it. – John Oct 3 '11 at 21:48

There are many ways to redirect iptables output to a separate file.

Iptables supports a a ULOG target, that will send all log messages to a netlink socket instead of the kernel syslog output. There are applications that can read from that ULOG socket and store your logs in databases or files.

For logging with the LOG target you can do things like set a prefix to the log entry, with --log-prefix, and if you are using a more advanced syslog daemon then you can filter based on that pattern, and save the entries into a separate file.

  • Thanks for the info. I am using rsyslog-4.6.2-2.el6.x86_64 that comes with CentOS. – John Oct 4 '11 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.