The Uncomplicated Firewall (UFW) is the default firewall configuration tool for Ubuntu servers. Out of the box, UFW is designed to silently block incoming traffic that does not match an explicit “allow” rule. While this silent dropping is excellent for general security, it provides zero visibility into who is attacking your server or which specific ports are being scanned. By enabling and configuring UFW’s built-in logging system, you can capture detailed telemetry about rejected connection attempts, allowing you to identify malicious IP addresses, detect port scanning bots, and troubleshoot misconfigured application routing.
Understanding UFW Log Levels
UFW supports several different logging levels, allowing you to control the sheer volume of data written to your system logs. The higher the level, the more verbose the logging becomes.
- off: Disables logging entirely. No blocked connections are recorded.
- low: Logs all blocked packets that do not match the defined policy, as well as packets matching logged rules. This is the recommended setting for most production servers, as it captures standard attacks without overwhelming the disk.
- medium: Logs everything in the ‘low’ level, plus all allowed packets not matching the defined policy, all invalid packets, and all new connections. This is useful for temporary troubleshooting.
- high: Logs all of the above, plus all packets with rate limiting. This generates a massive amount of data on a busy server.
- full: Logs every single packet that hits the firewall interface. Never leave this enabled permanently, as it will rapidly exhaust your disk space and slow down system I/O.
How to Enable UFW Logging
By default, UFW logging is usually set to ‘low’ when the firewall is enabled, but on some minimal server images, it is turned off entirely. You can enable it and set the desired level using a single command.
- Log into your Ubuntu server via SSH.
- Ensure UFW is active by running:
sudo ufw status. If it is inactive, you must enable it (but ensure you have allowed SSH first to prevent locking yourself out). - To enable standard logging, run:
sudo ufw logging on - This command automatically sets the logging level to ‘low’. If you wish to specify a different level, such as ‘medium’ for troubleshooting, you append the level to the command:
sudo ufw logging medium
The terminal will output “Logging enabled” or “Logging level changed.”
Where to Find the UFW Logs
Once enabled, UFW relies on the standard system logging daemon (usually rsyslog) to handle the output. By default, UFW logs are written to multiple files.
- The primary, dedicated file for firewall logs is:
/var/log/ufw.log - You can view the most recent blocked connections in real-time by using the
tailcommand:sudo tail -f /var/log/ufw.log
How to Read a UFW Log Entry
When you view the log, the output can look intimidating, consisting of a long string of capitalized abbreviations. Here is how to parse a standard entry:
Feb 14 10:22:45 server-01 kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:11:22... SRC=192.168.1.100 DST=10.0.0.5 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=11223 PROTO=TCP SPT=43212 DPT=22 WINDOW=1024 RES=0x00 SYN URGP=0- [UFW BLOCK]: Confirms the packet was rejected by the firewall.
- IN=eth0: The network interface the packet arrived on.
- SRC=192.168.1.100: The source IP address of the attacker. This is the most important piece of information.
- DST=10.0.0.5: Your server’s IP address.
- PROTO=TCP: The protocol being used (TCP, UDP, or ICMP).
- DPT=22: The Destination Port. In this example, port 22 indicates the attacker is attempting an SSH brute force attack.
Disabling Logging
If you were using ‘medium’ or ‘high’ logging to troubleshoot a specific routing issue and you have now resolved it, you should revert the logging back to ‘low’ or disable it entirely to conserve disk space.
To revert to the standard low level: sudo ufw logging low
To turn logging off completely: sudo ufw logging off