60

I have an Ubuntu server where I am blocking some IPs with ufw. I enabled logging, but I don't know where to find the logs. Where might the logs be or why might ufw not be logging?

Wesley
  • 32,690
  • 9
  • 82
  • 117
blockhead
  • 861
  • 1
  • 8
  • 13
  • Google is your friend http://askubuntu.com/questions/113439/ufw-is-not-logging-how-do-i-troubleshoot – user9517 Jun 19 '13 at 05:49

2 Answers2

70

Perform sudo ufw status verbose to see if you're even logging in the first place. If you're not, perform sudo ufw logging on if it isn't. If it is logging, check /var/log/ for files starting with ufw. For example, sudo ls /var/log/ufw*

If you are logging, but there are no /var/log/ufw* files, check to see if rsyslog is running: sudo service rsyslog status. If rsyslog is running, ufw is logging, and there are still no logs files, search through common log files for any mention of UFW. For example: grep -i ufw /var/log/syslog and grep -i ufw /var/log/messages as well as grep -i ufw /var/log/kern.log.

If you find a ton of ufw messages in the syslog, messages, and kern.log file, then rsyslog might need to be told to log all UFW messages to a separate file. Add a line to the top of /etc/rsyslog.d/50-default.conf that says the following two lines:

:msg, contains, “UFW” -/var/log/ufw.log
& ~

And you should then have a ufw.log file that contains all ufw messages!

NOTE:

Check the 50-default.conf file for pre-existing configurations.

Make sure to backup the file before saving edits!

UPDATE for Ubuntu Server 20.04 and later

As of Ubuntu 20.04 and later, the ~ is deprecated and should not be used, as reported in the ubuntu 20.04 system log:

rsyslogd: error during parsing file /etc/rsyslog.d/50-default.conf, on or before line 6: invalid character '�' - is there an invalid escape sequence somewhere? [v8.2001.0 try https://www.rsyslog.com/e/2207 ]
Jan 26 12:10:27 ubuntu rsyslogd: warning: ~ action is deprecated, consider using the 'stop' statement instead [v8.2001.0 try https://www.rsyslog.com/e/2307 ]

Rather, you should replace it with the word stop. So if you still want to log all ufw messages in rsyslog to a seperate ufw.log file then you should add the following to your /etc/rsyslog.d/50-default.conf file:

:msg, contains, “UFW” -/var/log/ufw.log
& stop

instead of

:msg, contains, “UFW” -/var/log/ufw.log
& ~
DanRan
  • 73
  • 1
  • 3
  • 22
Wesley
  • 32,690
  • 9
  • 82
  • 117
  • It looks like the `ufw status` (and `ufw status verbose`) commands return if the _firewall its self_ is running, not logging. If the command comes back as inactive, then I believe that means that ufw is totally disabled (which it is on my system). I'm curious now what firewall _is_ running! Edit: According to the [Ubuntu Server guide](https://help.ubuntu.com/lts/serverguide/firewall.html), there is no firewall enabled by default - iptables is essentially the firewall. You can follow the linked guide to get ufw running. – gcode Feb 27 '20 at 23:03
  • 1
    Maybe update your answer that these days there is /etc/rsyslog.d/20-ufw.conf with the correct config. – Carlo Wood Apr 12 '20 at 11:17
  • The output of `sudo ufw status verbose` is "Logging: on (low)". I have no logs. How can I set it to as high as possible? – Carlo Wood Apr 12 '20 at 11:18
9

You can also find UFW's logs in the kernel buffer.

sudo dmesg | grep '\[UFW'
Mahmoud
  • 191
  • 1
  • 3