--- title: 'firewall:logging' url: 'https://docs.danami.com/juggernaut/command-line-interface/firewall/firewall-logging' markdown: 'https://docs.danami.com/juggernaut/command-line-interface/firewall/firewall-logging.md' date: '2026-10-07' description: 'Configure the firewall logging settings. juggernaut --task=firewall:logging Option Value Default Description --SYSLOG <1|0> 0 Log the login failure daemon messages to SYSLOG. You must have the perl module Sys::Syslog installed to use this option. --DROP …' taxonomy: category: - docs tag: - monitoring --- [](#) [ Basics ](https://docs.danami.com/juggernaut/) [ Command Line Interface ](https://docs.danami.com/juggernaut/command-line-interface) Firewall firewall:logging # firewall:logging Configure the firewall logging settings. ``` juggernaut --task=firewall:logging ``` | Option | Value | Default | Description | |---|---|---|---| | `--SYSLOG` | <1\|0> | 0 | Log the login failure daemon messages to SYSLOG. You must have the perl module Sys::Syslog installed to use this option. | | `--DROP` | | DROP | The drop target for iptables rules. REJECT will send back an error packet and DROP will not respond at all. REJECT provides extra information to a hacker and lets them know that a firewall is blocking their attempts while DROP hangs their connection. | | `--DROP_OUT` | | REJECT | Drop target for outgoing iptables rules. This can be set to either DROP or REJECT as with DROP, however as such connections are from this server it is better to REJECT connections to closed ports rather than to DROP them. This helps to immediately free up server resources rather than tying them up until a connection times out. It also tells the process making the connection that it has immediately failed. It is possible that some monolithic kernels may not support the REJECT target. If this is the case, csf checks before using REJECT and falls back to using DROP, issuing a warning to set this to DROP instead. | | `--DROP_LOGGING` | <1\|0> | 1 | Enable logging of dropped connections to blocked ports to syslog. This option is required to use port scan tracking. | | `--DROP_IP_LOGGING` | <1\|0> | 0 | Enable logging of dropped incoming connections from blocked IP addresses. This option is disabled if you enable port scan tracking. | | `--DROP_OUT_LOGGING` | <1\|0> | 1 | Enable logging of dropped outgoing connections. Where available, these logs will also include the UID connecting out which can help track abuse. Note: Only outgoing SYN packets for TCP connections are logged, other protocols log all packets. We recommend that you enable this option. | | `--DROP_UID_LOGGING` | <1\|0> | 1 | Together with DROP\_OUT\_LOGGING enabled, this option logs the UID connecting out (where available) which can help track abuse. | | `--DROP_ONLYRES` | <1\|0> | 0 | Only log reserved port dropped connections. Ports 0 through 1023. | | `--DROP_NOLOG` | | 23,67,68,111,113,135:139,445,500,513,520 | Do not log these blocked ports. | | `--DROP_NOLOG_add` | | | Add a single entry to DROP\_NOLOG. | | `--DROP_NOLOG_del` | | | Remove a single entry from DROP\_NOLOG. | | `--DROP_PF_LOGGING` | <1\|0> | 0 | Log packets dropped by the packet filtering option PACKET\_FILTER | | `--CONNLIMIT_LOGGING` | <1\|0> | 0 | Log packets dropped by the Connection Limit Protection option CONNLIMIT. If this is enabled and Port Scan Tracking PS\_INTERVAL is also enabled, IP addresses breaking the Connection Limit Protection will be blocked. | | `--UDPFLOOD_LOGGING` | <1\|0> | 1 | Enable logging of UDP floods. This should be enabled, especially with User ID tracking enabled. | | `--default` | | | Reset all settings to their default values. | | `--default_option` |