UFW (Uncomplicated Firewall) · Event [UFW ALLOW]
[UFW ALLOW]: UFW logged a connection it let through
UFW recorded a permitted connection. These only appear once you raise the logging level above the default, which is the point most people miss — and at the highest level UFW logs every packet it sees, which will fill a small disk in hours.
Also written as [UFW ALLOW] IN=ufw allow log entryUFW AUDIT log meaningufw logging medium high full
- How oftenFires constantly
- Vendor calls itkern.info
- Logkern
What it means for you
For an analyst
The log levels are the whole story and they are not well advertised. 'low' logs blocked packets only, which is the default and where most people stop. 'medium' adds allowed packets and rate-limiting, 'high' removes most of the rate limiting on logging itself, and 'full' logs everything with no rate limit at all — that last one is a genuine hazard on a machine with a small root partition. The practical workflow is to raise to medium, confirm the rule you are debugging matches, and drop straight back to low. Leaving it at full over a weekend is a well-known way to fill a disk.
The fields that decide it
Everything else in the log line is context.
- The prefix
- Which decision UFW recorded, and under which logging behaviour.
-
[UFW ALLOW]A packet matching an allow rule. Only logged at medium and above. -
[UFW AUDIT]A packet being logged as it enters the chain, before a decision. Only at high and full, and the largest contributor to volume. -
[UFW AUDIT INVALID]A packet conntrack could not associate with a known connection. Common and usually harmless. -
[UFW BLOCK]A packet that was refused. Logged at every level including the default. - IN and OUT
- Which interface it arrived on and which it left by. An empty OUT means the packet was destined for this machine rather than passing through.
- SRC, DST, SPT, DPT
- The addresses and ports. When verifying a rule, DPT is what you check against the rule you just added.
- Log level in effect
- Not in the line itself. 'ufw status verbose' shows the current logging level, which determines what you will and will not see.
Common questions
Why do I see no [UFW ALLOW] entries in my log?
Because the default logging level is 'low', which records blocked packets only. Run 'ufw logging medium' to start recording allowed packets as well. Remember to set it back to low afterwards — medium and above generate substantially more volume, and on a busy host that adds up quickly.
What is the difference between [UFW ALLOW] and [UFW AUDIT]?
ALLOW records a packet that matched an allow rule and was permitted. AUDIT records a packet as it enters the chain, before any decision has been made, and appears only at the high and full logging levels. AUDIT lines are much more numerous and are the main reason the higher levels fill disks so fast.
How do I check that a UFW rule is actually working?
Set 'ufw logging medium', generate the traffic you expect the rule to permit, and look for a [UFW ALLOW] line with the matching destination port. Seeing the ALLOW confirms the rule matched; seeing a [UFW BLOCK] instead tells you it did not, and you are usually looking at rule ordering. Set logging back to low when you are done.
Is it safe to leave UFW logging on full?
Not on a machine with a small root partition. Full logging records every packet with no rate limiting, so an internet-facing host can produce gigabytes in a day, and a full disk causes far worse problems than the one you were debugging. Use full for a few minutes with a specific question in mind, then turn it back down.
Read next
- The equivalent of UFW BLOCK: Ubuntu's firewall dropped a packet The refusal, logged at every level including the default. The two together tell you whether a rule matched.
- The equivalent of iptables: a packet was logged by a firewall rule Raw netfilter LOG output, which is the same mechanism underneath without the UFW prefix.
- Read alongside nf_conntrack: table full — the firewall stopped accepting connections Connection tracking exhaustion, which produces INVALID entries and dropped connections that look like a firewall rule problem.
- Related Kernel: martian source — a packet arrived from the wrong direction Another kernel-level packet rejection, at the routing layer rather than the firewall.
Vendor documentation
Last reviewed 6 September 2026