Linux: Looking for a network log for server connections

Question

Is there a log in centos servers that records every connection to/from?

so something like a centralized connections log

Answer 1

The only sure way to get a single centralized log of all TCP connections would be to add LOG rules to your iptables software firewall configuration that would log any packet with a SYN and ACK bits set, i.e. the second packet of any TCP connection. These would appear as kernel log messages in /var/log/messages by default.

Please see this question at Server Fault.SE.

Essentially you would want to add iptables rules like this:

iptables -A OUTPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "Inbound connection established: "
iptables -A INPUT -p tcp --tcp-flags SYN,ACK SYN,ACK -j LOG --log-prefix "Outbound connection established: "

(You may want to place these rules in your existing ruleset so that they won't apply to the loopback interface, as that might generate two entries for each local connection between application processes within the host.)

And yes, the rule in OUTPUT chain records inbound connections and vice versa, because this will only log connections that are actually being responded to: recording just the SYN packets would also record connection attempts that will be rejected. Because of port scans executed by malware-ridden systems on the internet, that would often give you a lot of useless log entries: you would have to cross-check with other logs, only to find out that either you don't have such a service running at all, or that the connection was rejected by another iptables rule or by the service in question.

For UDP protocols it's trickier, because UDP is connectionless and basically just a platform on which an application-specific protocol can be built. So there is no easy way to detect "the first packet of a connection" or anything like that, because all that will be entirely application-specific.

Answer 2

I think this should do it:

journalctl -fu sshd

or

journalctl -u sshd -n 100

That is, if you're running systemd, which I think is default. The former will keep a watch. The latter is equivalent to piping through tail.

(Reading around seems to indicate that the logs should actually be in /var/log/secure)