Where are the logs for ufw located on Ubuntu Server?
Perform sudo ufw status verbose
to see if you're even logging in the first place. If you're not, perform sudo ufw logging on
if it isn't. If it is logging, check /var/log/
for files starting with ufw
. For example, sudo ls /var/log/ufw*
If you are logging, but there are no /var/log/ufw*
files, check to see if rsyslog
is running: sudo service rsyslog status
. If rsyslog is running, ufw is logging, and there are still no logs files, search through common log files for any mention of UFW
. For example: grep -i ufw /var/log/syslog
and grep -i ufw /var/log/messages
as well as grep -i ufw /var/log/kern.log
.
If you find a ton of ufw
messages in the syslog, messages, and kern.log file, then rsyslog might need to be told to log all UFW messages to a separate file. Add a line to the top of /etc/rsyslog.d/50-default.conf
that says the following two lines:
:msg, contains, “UFW” -/var/log/ufw.log
& ~
And you should then have a ufw.log file that contains all ufw
messages!
NOTE:
Check the 50-default.conf
file for pre-existing configurations.
Make sure to backup the file before saving edits!
You can also find UFW's logs in the kernel buffer.
sudo dmesg | grep '\[UFW'