Because the log messages don't appear in the journal anywhere, I suspect that you don't have syslog to journald forwarding set up correctly, and the messages are simply getting dropped. Since you're on Arch, this is easy to fix. Ensure that the syslog-ng
package is installed:
pacman -S syslog-ng
Then ensure that it's enabled on boot:
systemctl enable syslog-ng
Finally, since enabling services doesn't automatically start them, start the service:
systemctl start syslog-ng
See this Arch Wiki page for details.
Here's some background on why this problem occurs:
There is a certain way to log to classical syslog, and there is a certain way to log to the new systemd journal. These are incompatible; applications that support syslog cannot be magically made to support the journal - the author must explicitly implement this feature. Applications that support the systemd journal are generally referred to as supporting the "native API" when running on a systemd system.
Since the syslog API and the journald API are different, applications that don't support the journald API will just have their log messages dropped. This is what was happening in your case.
The syslog-ng
package's job is to translate syslog API calls into journald API calls. In this way, syslog messages eventually make it into the journal.
Debian Jessie does not remove syslog support by default. The old way (grepping through logs) should still work.
If you somehow accidentally removed syslog yourself, reinstall it:
apt install rsyslog
Best Answer
If there is no additional logger configured, all UFW events should be logged to systemd journal by default.
UFW entries have the following format:
Try
journalctl | grep -i ufw
to search for all UFW entries regardless letter case.