rsyslog - Property-based filtering not working

Question

I almost hate to submit a topic for this, but I haven't been able to figure it out on my own. I'm running a Federoa 17 server, and I'm attempting to log dropped packets from iptables to a separate log file via rsyslog, but it keeps sending them to /var/log/messages instead.

Snippet from my firewall script:

#!/bin/bash
iptables -F

# My accepted rules would be here

iptables -A INPUT -j LOG --log-prefix "iptables: "
iptables -A FORWARD -j LOG --log-prefix "iptables: "

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

iptables-save > /etc/sysconfig/iptables
service iptables restart
iptables -L -v

The config file that SHOULD be catching the messages from iptables:

[root@fc17 ]# cat /etc/rsyslog.d/iptables.conf 
:msg, startswith, "iptables: "  /var/log/iptables.log
& ~

Snippet from my rsyslog.conf file:

#### GLOBAL DIRECTIVES ####

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

#### RULES ####
# I put this in here too to see if it would work; it doesn't
:msg, startswith, "iptables: "  /var/log/iptables.log
& ~

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

I've restarted both iptables and rsyslog multiple times since making the changes, and no matter what, it will only only log dropped packets from iptables to /var/log/messages.

I heard running rsyslog in compatibility mode can cause various problems. Could this be the case here? Here are its run-options on my system:

[root@fc17 ]# ps -ef | grep rsyslog
root      3571     1  0 00:59 ?        00:00:00 /sbin/rsyslogd -n -c 5

Answer 1

startswith comparison operator didn't work,because msg didn't begin with iptables: when i checked my logs.

[root@localhost ~]# cat /etc/rsyslog.d/test.conf 
:msg, startswith, "iptables:"  /var/log/iptables.log

but contains comparison operator worked on my FC18

[root@localhost ~]# cat /etc/rsyslog.d/test.conf 
:msg, contains, "iptables:"  /var/log/iptables.log

Ref: Rsyslog site

Answer 2

you should add the following two line in your "/etc/rsyslogd.conf" in directives part

$klogParseKernelTimestamp on
$klogKeepKernelTimestamp off

This will remove the kernel timestamp which appears in the begining of every kernel message like "[6448.546951]" in the following log

Mar 31 14:36:14 localhost kernel: [ 6448.546951] iptables: IN=ppp0 OUT= MAC= SRC= 

Answer 3

2019 solution. Tested with rsyslogd 8.32.0 on Ubuntu18.04.

You can still use startswith,

[root@localhost ~]# cat /etc/rsyslog.d/test.conf 
:msg, startswith, " iptables:"  /var/log/iptables.log

by changing the line in /etc/rsyslogd.conf

module(load="imklog" ParseKernelTimestamp="on" KeepKernelTimestamp="off")

Answer 4

I'm using rsyslogd 5.8.10 over centos 6, my log report show this way:

Aug 12 11:50:41 node2 kernel: [10256396.525411] IPTables-Dropped: IN=eth0 OUT= MAC=00:25:90:c3:05:40:00:24:13:10:8c:00:08:00 SRC=212.237.40.56 DST=37.153.1.29 LEN=45 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=UDP SPT=45661 DPT=53413 LEN=25 

I tried to disabled the timestamp with:

$klogParseKernelTimestamp on
$klogKeepKernelTimestamp off

But show:

Aug 12 11:50:22 node2 rsyslogd-3003: invalid or yet-unknown config file command - have you forgotten to load a module? [try http://www.rsyslog.com/e/3003 ]

In modules have this:

#### MODULES ####

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

Thank you advance.