Remove UFW Block from kern.log and sys.log
UFW configuration option only toggles logging on/off (and alternatively specifies custom logging level):
logging on|off|LEVEL
toggle logging. Logged packets use the
LOG_KERN
syslog facility. Systems configured forrsyslog
support may also log to/var/log/ufw.log
. Specifying aLEVEL
turns logging on for the specifiedLEVEL
. The default log level islow
.
If you are using standard Ubuntu installation, you have rsyslogd
extension, which can be (and by default is) configured to generate these separated log files.
In Ubuntu 16.04, UFW logging configuration should be in /etc/rsyslog.d/20-ufw.conf
:
# Log kernel generated UFW log messages to file
:msg,contains,"[UFW " /var/log/ufw.log
# Uncomment the following to stop logging anything that matches the last rule.
# Doing this will stop logging kernel generated UFW log messages to the file
# normally containing kern.* messages (eg, /var/log/kern.log)
#& ~
As the comment describes, you should just uncomment the last line. If there isn't one, just add & ~
.
Contrariwise, commenting out the other configuration line causes logging only to syslog
/ kern.log
.
2: Using a firewall to block attacks, as you already do, is the correct way to handle the situation.