Where is iptables log?

Jason.nix · 08-16-2023, 08:53 AM

Hello,
I don't know how can I see the firewall log? For example, I want to see the all input attempts.
The new version of Debian has not any /var/log/kern.log file. I guess that I must use the journalctl utility.
Please consider the following iptables rule:

Code:

iptables -A INPUT -j LOG --log-prefix='[netfilter]'

If any login attempts have occurred from any port, then the following command must show it:

Code:

# journalctl -k | grep netfilter

Am I right?

Thank you.

GlennsPref · 08-16-2023, 04:20 PM

This shows me kernel messages in syslog.

Code:

cat /var/log/syslog | grep kernel

I don't know much about "journalctl", I stopped using those systemd distros.

My recently updated Devuan 5.0 still has /var/log/kern.log

this might help...
https://tecadmin.net/enable-logging-...bles-on-linux/

frankbell · 08-16-2023, 08:19 PM

This article might help: https://www.putorius.net/how-to-log-...ssages-to.html

Jason.nix · 08-19-2023, 02:05 PM

Quote:

Originally Posted by GlennsPref

This shows me kernel messages in syslog.

Code:

cat /var/log/syslog | grep kernel

I don't know much about "journalctl", I stopped using those systemd distros.

My recently updated Devuan 5.0 still has /var/log/kern.log

this might help...
https://tecadmin.net/enable-logging-...bles-on-linux/

Hello,
Thank you so much.
Your articled used the Syslog

Jason.nix · 08-19-2023, 02:08 PM

Quote:

Originally Posted by frankbell

This article might help: https://www.putorius.net/how-to-log-...ssages-to.html

Hello,
Thank you so much for your reply.
When my iptables rule is:

Code:

iptables -A INPUT -j LOG --log-prefix='[netfilter]'

Then, I must consider the square brackets in my filter:

Code:

# journalctl -k | grep [netfilter]

Am I right?

jens · 08-20-2023, 11:16 AM

Quote:

Originally Posted by Jason.nix

Hello,
I don't know how can I see the firewall log? For example, I want to see the all input attempts.
The new version of Debian has not any /var/log/kern.log file. I guess that I must use the journalctl utility.
Please consider the following iptables rule:

Code:

iptables -A INPUT -j LOG --log-prefix='[netfilter]'

If any login attempts have occurred from any port, then the following command must show it:

Code:

# journalctl -k | grep netfilter

Am I right?

Thank you.

Their have been two changes when it comes iptables and logging (nftables and rsyslog/journald).

iptables was replaced by nftables starting with Debian 10 (Buster)
iptables is still available and you can switch back and forth between iptables-nft and iptables-legacy as explained here:
https://wiki.debian.org/iptables
Using nftables is encouraged: https://wiki.debian.org/nftables

Rsyslog has been deprecated since Debian 12 (Bookworm)
While you can still install and use rsyslog with journald, this isnt encouraged either.
https://wiki.debian.org/Rsyslog#Deprecation_in_Bookworm

Jason.nix · 08-21-2023, 05:38 AM

Quote:

Originally Posted by jens

Their have been two changes when it comes iptables and logging (nftables and rsyslog/journald).

iptables was replaced by nftables starting with Debian 10 (Buster)
iptables is still available and you can switch back and forth between iptables-nft and iptables-legacy as explained here:
https://wiki.debian.org/iptables
Using nftables is encouraged: https://wiki.debian.org/nftables

Rsyslog has been deprecated since Debian 12 (Bookworm)
While you can still install and use rsyslog with journald, this isnt encouraged either.
https://wiki.debian.org/Rsyslog#Deprecation_in_Bookworm

Hello,
Thank you so much for your reply.
So, in the new version of Debian, how you can see your iptables logs?

pan64 · 08-21-2023, 05:53 AM

probably here: https://tecadmin.net/enable-logging-...bles-on-linux/
But obviously, you need to have syslogd to use it.