Where to Find UFW Logs on Arch Linux

arch linuxlogsufw

UFW is enabled and logging is set to HIGH on my Arch Linux system. I am sure that it is running and blocking some of my connection attempts. However I cannot find any logs. The places/commands I tried to check:

  • journalctl -u ufw
  • journalctl | grep ufw
  • /var/log/ufw* (not found)
  • /var/log/messages (not found)
  • /var/log/syslog (not found)
  • /var/log/kern.log (not found)

Where are the logs for UFW located on Arch Linux?

Best Answer

If there is no additional logger configured, all UFW events should be logged to systemd journal by default.

UFW entries have the following format:

Sep 13 21:52:11 xps kernel: [UFW BLOCK] IN=wlp58s0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.103 DST=192.168.1.209 LEN=545 TOS=0x00 PREC
Sep 13 21:52:12 xps kernel: [UFW BLOCK] IN=wlp58s0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.103 DST=192.168.1.209 LEN=545 TOS=0x00 PREC
Sep 13 21:52:13 xps kernel: [UFW BLOCK] IN=wlp58s0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.1.103 DST=192.168.1.209 LEN=545 TOS=0x00 PREC

Try journalctl | grep -i ufw to search for all UFW entries regardless letter case.

Related Question