I am trying to redirect iptables log to another file. Based upon my reading on the net, I did the following:
In my iptables rule, I have rules like:
iptables -A INPUT -s … -j LOG –log-prefix "iptables@@"
Then in the folder /etc/rsyslog.d, I created a file with the entries:
:msg,contains,"iptables@@" /var/log/iptables.log
& ~
I also tried to have a blank line between the above two lines. I do get the iptables log entries now going to iptables.log file. But they ALSO go to /var/log/kern.log file. I want to suppress the later. How do I do this. I am running Ubuntu 14.04 LTS.
Best Answer
When your /etc/rsyslog.conf loads yours *.conf in /etc/rsyslog.d, it reads your files alphabetically. So, you need to make sure that your rules are in a file that comes before 50-default.conf, like:
This way, your rules will be read first, and discard it. You should also use this syntax:
*You should use stop instead of ~
Or if you don't have others kern.* than your iptables messages, you should modify 50-default.conf with: