I'm attempting to diagnose a packet forwarding issue on my Android 9 phone. I've added a -j LOG rule to my FORWARD chain. How can I access the logged messages?

According to this guide, I first need to alter the syslog configuration file which is either at /etc/syslog.conf or /etc/rsyslog.conf. However, neither of those files exist on my phone.

1 Answer 1


Android has a different userland and indeed doesn't use these log files (even modern Linux desktop distros don't use these files usually). So, that guide is wrong today (even if it claims it was written not a month ago!)¹ for desktop Linux and wouldn't have ever applied to Android to begin with.

Now, iptables is not the usual way the Android userland interacts with netfilter / *btables in the kernel. So, it's unknown how that logging is exactly implemented – chances are that whoever built the kernel modules for the logging chain in the netfilter kernel side modified them.

If, however, the logging code itself is unmodified, then the packets will be logged to the kernel log (the thing you can read using dmesg on a desktop Linux). Now, it's unusual for an Android Linux to have the dmesg utility. Not that much of a problem – you can just read /proc/kmsg yourself.

¹ Hint: when you find a guide on a basic technology and it is from some random "tech advice" website, and especially if it claims a recent modification date, chances are it's machine-generated or cheaply-without-understanding-anything-copied-together content :( That's the sad state of the internet: Content generation from unquoted sources for the sole purpose of traffic maximization, hoping to scrape the bottom of the advertisement revenue barrel :( These clutter the top search engine results very reliably. Let me tell you (shakes walking stick at cloud) back in my day, searching the internet was actually better.

  • How does Android typically interact with netfilter? Feb 13, 2023 at 18:08
  • through the netlink kernel interface, just like the iptables program does internally. Feb 13, 2023 at 18:12
  • Oh, you mean like creating AF_NETLINK sockets? Feb 13, 2023 at 18:13
  • 1
  • 1
    @AugustVrubel :D not saying those were not the days, but honestly, Google's utility in finding technically accurate content has sharply dropped recently, especially since they default to "yeah I can just choose to ignore parts of your query, the search algorithm knows better than you" instead of "if a result doesn't contain all words from the query, it's not a result". Feb 13, 2023 at 18:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .