I have an Ubuntu server where I am blocking some IPs with
ufw. I enabled logging, but I don't know where to find the logs. Where might the logs be or why might
ufw not be logging?
sudo ufw status verbose to see if you're even logging in the first place. If you're not, perform
sudo ufw logging on if it isn't. If it is logging, check
/var/log/ for files starting with
ufw. For example,
sudo ls /var/log/ufw*
If you are logging, but there are no
/var/log/ufw* files, check to see if
rsyslog is running:
sudo service rsyslog status. If rsyslog is running, ufw is logging, and there are still no logs files, search through common log files for any mention of
UFW. For example:
grep -i ufw /var/log/syslog and
grep -i ufw /var/log/messages as well as
grep -i ufw /var/log/kern.log.
If you find a ton of
ufw messages in the syslog, messages, and kern.log file, then rsyslog might need to be told to log all UFW messages to a separate file. Add a line to the top of
/etc/rsyslog.d/50-default.conf that says the following two lines:
:msg, contains, “UFW” -/var/log/ufw.log & ~
And you should then have a ufw.log file that contains all
Do I need to tell you to check the
50-default.conf file for pre-existing references to
ufw? Do I need to tell you to backup the
50-default.conf file to
50-default.conf.date before making any changes? No... no I don't. You know that already.
You can also find UFW's logs in the kernel buffer.
sudo dmesg | grep '\[UFW'