Read and tune UFW firewall logs

Firewall logs answer two questions: what is being blocked, and is something I need being blocked by mistake? UFW can log every dropped packet, but the default output looks cryptic and can grow fast. This guide shows how to pick a sensible logging level, where the lines are written, how to read each field and how to keep the volume down.

Before you start

• A Linux VPS running Ubuntu 22.04, Ubuntu 24.04 or Debian 12 with UFW active. New to UFW? Start with Set up the UFW firewall on Ubuntu and Debian.
• A sudo user connected over SSH.

Logging only records traffic. It never changes what UFW allows or blocks, so the commands here cannot lock you out.

Choose a logging level

Check the current setting:

sudo ufw status verbose

The line Logging: on (low) shows the level. Change it with:

sudo ufw logging low

The levels, from quietest to loudest:

• off: no logging from UFW's default policy.
• low: blocked packets that do not match any rule, plus packets that match rules you marked for logging. Rate-limited. The right choice for most servers.
• medium: everything in low, plus invalid packets, new connections and allowed packets that do not match a rule. Rate-limited. Useful for short debugging sessions.
• high: medium without the rate limit on those messages, plus all packets with rate limiting.
• full: everything, with no rate limit.

sudo ufw logging on is the same as low. Use medium or above only while you investigate a problem, then set it back.

Find the blocked lines

UFW writes through the kernel log. Where the lines end up depends on the system:

• Ubuntu: rsyslog copies them to /var/log/ufw.log.
• Debian 12: rsyslog is not installed by default, so read them from the systemd journal.

The journal works on both:

sudo journalctl -k --since "1 hour ago" | grep 'UFW BLOCK'

Follow new lines live, which is handy while you test from another machine:

sudo journalctl -kf | grep --line-buffered 'UFW BLOCK'

On Ubuntu you can also use:

sudo tail -f /var/log/ufw.log

You may see other tags too. [UFW LIMIT BLOCK] comes from ufw limit rules. [UFW AUDIT] and [UFW ALLOW] appear at medium level and above.

Read a UFW BLOCK line

A typical entry looks like this:

[UFW BLOCK] IN=eth0 OUT= MAC=52:54:00:aa:bb:cc:52:54:00:dd:ee:ff:08:00 SRC=198.51.100.20 DST=203.0.113.10 LEN=44 TOS=0x00 PREC=0x00 TTL=243 ID=31337 PROTO=TCP SPT=48211 DPT=3306 WINDOW=1024 RES=0x00 SYN URGP=0

The fields that matter:

• IN / OUT: the network interface. IN=eth0 with an empty OUT= means incoming traffic to this server. A filled OUT= with empty IN= means traffic the server tried to send.
• SRC: the address the packet came from. This is who tried to connect.
• DST: the address it was sent to, normally your server's IP.
• PROTO: TCP, UDP or ICMP. Firewall rules are protocol-specific, so this tells you which rule would be needed.
• SPT / DPT: source and destination port. DPT is the port on your server that was hit. DPT=3306 means someone tried MySQL.
• SYN: the packet was the start of a new TCP connection.
• TTL, LEN, ID, WINDOW: low-level packet details. You can usually ignore them.

So the line above reads: 198.51.100.20 tried to open a TCP connection to MySQL on port 3306 and UFW dropped it. That is the firewall doing its job.

Summarise the logs

Single lines are noise. Counts show patterns. The top source addresses today:

sudo journalctl -k --since today | grep 'UFW BLOCK' | grep -o 'SRC=[^ ]*' | sort | uniq -c | sort -rn | head

The most-probed ports:

sudo journalctl -k --since today | grep 'UFW BLOCK' | grep -o 'DPT=[^ ]*' | sort | uniq -c | sort -rn | head

Port scans across 22, 23, 3389 and 445 are normal background noise on any public IP. Look instead for blocks on ports you expect to be open. Those point to a missing rule.

Log specific rules

You can turn on logging for one rule without raising the global level. log records new connections that match; log-all records every matching packet:

sudo ufw allow log 22/tcp
sudo ufw deny log from 198.51.100.0/24

Matching lines are tagged [UFW ALLOW] or [UFW BLOCK] like the others. Use this to watch who reaches a sensitive port.

Stop log spam

• Set the level back to low: sudo ufw logging low.
• Remove log or log-all from rules you no longer watch by deleting and re-adding them without the keyword.
• Block a very noisy source with a plain deny rule. See Block an IP address or subnet with UFW.
• Cap the journal size, for example sudo journalctl --vacuum-size=200M, and set SystemMaxUse= in /etc/systemd/journald.conf to keep it there.
• On Ubuntu, /var/log/ufw.log is rotated by logrotate. Check /etc/logrotate.d/rsyslog if it grows too large.

Check it works

From another computer, try a port you have not opened:

nc -vz -w 3 203.0.113.10 5432

On the server, a new [UFW BLOCK] line should appear within a second, showing your computer's address as SRC= and DPT=5432.

Troubleshooting

• No UFW lines at all: logging is off or UFW is inactive. Run sudo ufw status verbose, then sudo ufw logging low.
• /var/log/ufw.log does not exist: rsyslog is not installed, which is normal on Debian 12. Use journalctl -k.
• Your own service is being blocked: find its DPT and PROTO in the log and add a matching allow rule. Remember a TCP rule does not cover UDP.
• UFW lines also flood the main syslog: check that /etc/rsyslog.d/20-ufw.conf exists and ends with & stop, then restart rsyslog.

Next steps

• Turn what you find into rules: Open ports with UFW: single ports, ranges and trusted IPs.
• Slow down repeat SSH connections: Rate-limit SSH and other ports with ufw limit.
• Ban log offenders automatically with Fail2ban: Install and configure Fail2ban.