Re: How can I view detailed log of IPTABLES

[Alistair Tonner <Alistair@nerdnet.ca>]

On June 18, 2003 08:27 am, Deshwal Chand wrote:
> Hi
>
> I have IPTABLES 1.2.5 at Redhat 2.4.7-10. I am not able to see the logs
> generated by IPTABLES. May I haven't enalbed logging for iptables. How can
> I enable logging?
>
>
> Chand

	By default iptables logs nothing.  You must create specific rules to log 
anything.	
	Generally you only want to see certain things logged.  Thus just as you would
	craft rules to handle specific packets, one must craft rules to log, just use
	the -j LOG target.

	The best logging rules should be the last rule in a chain, and trap
	 everything, just before the chain's policy (often drop) kicks in.

	e.g  this is the last line in my INPUT chain.  Logging, with limits.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT INPUT packet died: "

	note that I don't filter *any* packets here ..the policy in INPUT is drop.
	thus I now see all packets dropped by my INPUT chain.

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!