Is there any option to enable Iptables log to syslog?

This is a very common query that every Linux server admins have.

Fortunately, the log feature in Iptable is a possible fix for this situation.

At Bobcares, we often get requests to fix Iptables errors, as a part of our Server Management Services.

Today, let’s see How our Support Engineers log Iptables messages to syslog.

Iptables and logging messages

Setting up a firewall is the best way to manage network traffic. The default firewall is Iptables in most Linux flavors.

Hence, Iptables is a command-line firewall service. But, errors are troublesome in any service. This demands the need for logs.

Consider the situation where Iptables is not working properly. And there is no way to find the reason. Isn’t it frustrating? Here is where log messages come to rescue.

If there are logs to explain the events, then it is a halfway to fix. Hence, our Support Engineers always suggest logging Iptables activities.

Iptables can log the network activity to system logs. This helps in identifying errors and make a report of activities. Today, let’s see how we do it.

How to log Iptables activities to syslog?

Firstly, we enable logging using the command

iptables -A INPUT -j LOG

Iptables also enables to log activities from certain IPs. Similarly, we can enable a log level by specifying the log-level number.

In addition, we can add a prefix in logs. This is useful in searching logs from huge data.

Now, the default log is /var/log/messages in most Linux flavors.  For Ubuntu and Debian the details are logged in /var/log/kern.log.

We always make sure this by checking this log location after enabling the logs.

Some customers approach us to change the log location to syslog. The default location of syslog is /etc/syslog.conf. In this case, our Support Engineers edit the syslog.conf file.

Before making changes to the configuration file, we always make sure to take a backup of this file. Then, we add the following line to it.

kern.warning /var/log/iptables.log

Finally, we restart the syslogd service. For instance, in a CentOS system, we use the command,

sudo /etc/init.d/syslog restart

Now, we are able to see Iptables logs in syslog.

[Need assistance to log iptables messages to syslog? – We’ll help you.]

Conclusion

In short, we can enable the Iptables log to syslog.  This is useful in fixing errors related to Iptables. And helps in monitoring networking activities. Today, we saw how our Support Engineers enable this.