0

My requirements are to do extensive logging of various iptables rules that must be logged into a file other than Syslog or the Journal.

For some time have been using ulogd that enables setting up custom log files. However ulogd isn't supported in systemd on Fedora, that seems to indicate it is no longer a preferred option, and may be going the way of the dodo bird.

Wondering if there is a newer preferred option? (conntrack doesn't seem to provide full logging to a file.)

EDIT: Ok - some more details. Am using ipset that blocks and or logs traffic from particular countries. So for example, if there is outgoing traffic to particular countries, we need to know about it and investigate further. Having a large volume of logging information from iptables rules going into Syslog (and the new Journal used in Fedora) means that normal Syslog messages are swamped and important messages are being missed due to the volume of iptables logs. Hence we need to separate the normal Syslog messages from the high volume iptables logs

  • My requirements are to do extensive logging of various iptables rules You need to explain that better to give us a better understanding so we can give more accurate answers. At the moment, this is an XY Problem: meta.stackexchange.com/a/66378/205010 – fukawi2 Nov 12 '13 at 2:56
  • Ok - some more details. Am using ipset that blocks and or logs traffic from particular countries. So for example, if there is outgoing traffic to particular countries, we need to know about it and investigate further. Having a large volume of logging information from iptables rules going into Syslog (and the new Journal used in Fedora) means that normal Syslog messages are swamped and important messages are being missed due to the volume of iptables logs. Hence we need to separate the normal Syslog messages from the high volume iptables logs. – Eureka Ikara Nov 12 '13 at 5:39
1

Perhaps the NFLOG target could be useful to you? I've never used it, but it sounds like it's what you're after?

This target provides logging of matching packets. When this target is set for a rule, the Linux kernel will pass the packet to the loaded logging backend to log the packet. This is usually used in combination with nfnetlink_log as log‐ ging backend, which will multicast the packet through a netlink socket to the specified multicast group. One or more userspace processes may subscribe to the group to receive the packets. Like LOG, this is a non-terminating target, i.e. rule traversal continues at the next rule.

(Emphasis added)

  • Thanks for the suggestion. Actually in Fedora 19 ulogd now uses the NFLOG target as the ULOG target is deprecated. However, to add to my concerns about ulogd is that it causes lots of SELinux permission problems as there does not seem to be any up-to-date SELinux policy for it. Hence my thinking that maybe there is another solution I have not been able to find. – Eureka Ikara Nov 13 '13 at 22:13
0

use the following iptables directive after you run "man iptables"

-j LOG

  • But the problem is that I have not been able to come up with a solution that doesn't log these messages to Syslog. I have been able to come up a solution that logs them to another file, but they also get logged to Syslog, which is what I need to avoid. – Eureka Ikara Nov 12 '13 at 5:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.