path: root/doc/statements.txt
diff options
authorPhil Sutter <>2018-10-27 12:15:50 +0200
committerPablo Neira Ayuso <>2018-10-29 11:15:08 +0100
commitf27fc14cbd3097e98c4d3549ff93c9284134b866 (patch)
tree818e2fa552b79ec34d148c8450018d9e2685e1cb /doc/statements.txt
parentbb32d8db9a125d9676f87866e48ffbf0221ec16a (diff)
nft.8: Document log level audit
Since this pseudo log level fundamentally changes behaviour of log statement, dedicate this mode a separate paragraph. Signed-off-by: Phil Sutter <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'doc/statements.txt')
1 files changed, 14 insertions, 4 deletions
diff --git a/doc/statements.txt b/doc/statements.txt
index 39d9f144..51dd0b37 100644
--- a/doc/statements.txt
+++ b/doc/statements.txt
@@ -64,16 +64,26 @@ LOG STATEMENT
*log* [prefix 'quoted_string'] [level 'syslog-level'] [flags 'log-flags']
*log* group 'nflog_group' [prefix 'quoted_string'] [queue-threshold 'value'] [snaplen 'size']
+*log* level audit
The log statement enables logging of matching packets. When this statement is
used from a rule, the Linux kernel will print some information on all matching
packets, such as header fields, via the kernel log (where it can be read with
-dmesg(1) or read in the syslog). If the group number is specified, the Linux
+dmesg(1) or read in the syslog).
+In the second form of invocation (if 'nflog_group' is specified), the Linux
kernel will pass the packet to nfnetlink_log which will multicast the packet
through a netlink socket to the specified multicast group. One or more userspace
processes may subscribe to the group to receive the packets, see
-libnetfilter_queue documentation for details. This is a non-terminating
-statement, so the rule evaluation continues after the packet is logged.
+libnetfilter_queue documentation for details.
+In the third form of invocation (if level audit is specified), the Linux
+kernel writes a message into the audit buffer suitably formatted for reading
+with auditd. Therefore no further formatting options (such as prefix or flags)
+are allowed in this mode.
+This is a non-terminating statement, so the rule evaluation continues after
+the packet is logged.
.log statement options
@@ -84,7 +94,7 @@ Log message prefix|
quoted string
Syslog level of logging |
-string: emerg, alert, crit, err, warn [default], notice, info, debug
+string: emerg, alert, crit, err, warn [default], notice, info, debug, audit
NFLOG group to send messages to|
unsigned integer (16 bit)