ufw ログ

Solution: Configure rsyslog log message patterns
Edit /etc/rsyslog.d/20-ufw.conf and uncomment the last line, leaving & stop there. This prevents the message from being logged into the syslog too.

$ vim /etc/rsyslog.d/20-ufw.conf

# Log kernel generated UFW log messages to file
:msg,contains,"[UFW " /var/log/ufw.log

# Uncomment the following to stop logging anything that matches the last rule.
# Doing this will stop logging kernel generated UFW log messages to the file
# normally containing kern.* messages (eg, /var/log/kern.log)
& stop

Restart the rsyslog service afterward.

$ systemctl restart rsyslog

https://dnsmichi.at/2022/06/02/disable-ufw-block-messages-in-syslog-on-ubuntu/

この対応だとjournal ログに引き続き出力される

https://askubuntu.com/questions/828223/disable-logging-of-ufw-blocks-in-the-kernel-logs

$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

ufwのログについての基本 - とあるシステムの中の人 2024