How can I view detailed log of IPTABLES

How can I view detailed log of IPTABLES

[Deshwal Chand]

[-- Attachment #1: Type: text/plain, Size: 178 bytes --]

Hi 

I have IPTABLES 1.2.5 at Redhat 2.4.7-10. I am not able to see the logs
generated by IPTABLES. May I haven't enalbed logging for iptables. How can I
enable logging?


Chand

[-- Attachment #2: Type: text/html, Size: 620 bytes --]

Re: How can I view detailed log of IPTABLES

[Alistair Tonner]

On June 18, 2003 08:27 am, Deshwal Chand wrote:
> Hi
>
> I have IPTABLES 1.2.5 at Redhat 2.4.7-10. I am not able to see the logs
> generated by IPTABLES. May I haven't enalbed logging for iptables. How can
> I enable logging?
>
>
> Chand

	By default iptables logs nothing.  You must create specific rules to log 
anything.	
	Generally you only want to see certain things logged.  Thus just as you would
	craft rules to handle specific packets, one must craft rules to log, just use
	the -j LOG target.

	The best logging rules should be the last rule in a chain, and trap
	 everything, just before the chain's policy (often drop) kicks in.

	e.g  this is the last line in my INPUT chain.  Logging, with limits.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT INPUT packet died: "

	note that I don't filter *any* packets here ..the policy in INPUT is drop.
	thus I now see all packets dropped by my INPUT chain.

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

Re: How can I view detailed log of IPTABLES

[Volker Augustin]

hi,

simply set up a log-chain for accepting and/or rejecting packages
first jump to the log chain, then reject, deny, allow... from there :)

do a simple google for 'iptables+logfile' , this results in a lot of sites
with many hints.
i did the same thing, you also may have to change your settings in
/etc/syslog.conf ;)
it realy depends on what you like to log... dont log too much, this will
result in a very-big logfile, .....(think of your hd-space in /var/ or
somewhere else...)

volker


----- Original Message -----
From: "Deshwal Chand" <CDD@kampsax.co.in>
To: "Netfilter (E-mail)" <netfilter@lists.netfilter.org>
Sent: Wednesday, June 18, 2003 2:27 PM
Subject: How can I view detailed log of IPTABLES


> Hi
>
> I have IPTABLES 1.2.5 at Redhat 2.4.7-10. I am not able to see the logs
> generated by IPTABLES. May I haven't enalbed logging for iptables. How can
I
> enable logging?
>
>
> Chand
>

RE: How can I view detailed log of IPTABLES

[Deshwal Chand]

[-- Attachment #1: Type: text/plain, Size: 1440 bytes --]

I have set the log level in iptables to 5 (notice). But no log appears in
the message file.

 

 



-----Original Message-----
From: Alistair Tonner [mailto:Alistair@nerdnet.ca]
Sent: Wednesday, June 18, 2003 8:00 PM
To: Deshwal Chand; Netfilter (E-mail)
Subject: Re: How can I view detailed log of IPTABLES


On June 18, 2003 08:27 am, Deshwal Chand wrote:
> Hi
>
> I have IPTABLES 1.2.5 at Redhat 2.4.7-10. I am not able to see the logs
> generated by IPTABLES. May I haven't enalbed logging for iptables. How can
> I enable logging?
>
>
> Chand

	By default iptables logs nothing.  You must create specific rules to
log 
anything.	
	Generally you only want to see certain things logged.  Thus just as
you would
	craft rules to handle specific packets, one must craft rules to log,
just use
	the -j LOG target.

	The best logging rules should be the last rule in a chain, and trap
	 everything, just before the chain's policy (often drop) kicks in.

	e.g  this is the last line in my INPUT chain.  Logging, with limits.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT INPUT packet died: "

	note that I don't filter *any* packets here ..the policy in INPUT is
drop.
	thus I now see all packets dropped by my INPUT chain.

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

[-- Attachment #2: Type: text/html, Size: 3435 bytes --]