Edit syslog configuration file vim /etc/rsyslog.d/50-default.conf Restart rsyslog service service rsyslog restart Change owner of the firewall.log file chown syslog:adm /var/log/firewall.log After “kern.* -/var/log/kern.log” line add #iptables Log