Libreswan can be compiled using HAVE_STATSD=true This will cause libreswan to log all state changes by calling a binary, currently hardcoded to /bin/libreswan-statsd It will log the state changes as arguments to that binary which is called using system() As an example, to log these to a file called /tmp/stats.out you can do: cat > /bin/libreswan-statsd < EOF #!/bin/sh echo "$*" >> /tmp/stats.out EOF chmod 755 /bin/libreswan-statsd Example output (where we have a conn l2tp-psk) push ipsec-tunnel-l2tp-psk if_stats /proc/net/dev/eth0 ; push ipsec-tunnel-l2tp-psk tunnel phase1up ; push ipsec-tunnel-l2tp-psk phase1 unknown ; push ipsec-tunnel-l2tp-psk phase2 unknown nfmark me/him 4986003/4986003 push ipsec-tunnel-l2tp-psk if_stats /proc/net/dev/eth0 ; push ipsec-tunnel-l2tp-psk tunnel phase2 ; push ipsec-tunnel-l2tp-psk phase1 unknown ; push ipsec-tunnel-l2tp-psk phase2 neg nfmark me/him 4986003/4986003 push ipsec-tunnel-l2tp-psk if_stats /proc/net/dev/eth0 ; push ipsec-tunnel-l2tp-psk tunnel up ; push ipsec-tunnel-l2tp-psk phase1 unknown ; push ipsec-tunnel-l2tp-psk phase2 unknown nfmark me/him 4986003/65536 push ipsec-tunnel-l2tp-psk if_stats /proc/net/dev/eth0 ; push ipsec-tunnel-l2tp-psk tunnel phase1up ; push ipsec-tunnel-l2tp-psk phase1 unknown ; push ipsec-tunnel-l2tp-psk phase2 unknown nfmark me/him 4986003/65536 push ipsec-tunnel-l2tp-psk if_stats /proc/net/dev/eth0 ; push ipsec-tunnel-l2tp-psk tunnel unknown ; push ipsec-tunnel-l2tp-psk phase1 unknown ; push ipsec-tunnel-l2tp-psk phase2 unknown nfmark me/him 4986003/4986003 push ipsec-tunnel-l2tp-psk if_stats /proc/net/dev/eth0 ; push ipsec-tunnel-l2tp-psk tunnel phase1up ; push ipsec-tunnel-l2tp-psk phase1 unknown ; push ipsec-tunnel-l2tp-psk phase2 unknown nfmark me/him 4986003/65536 push ipsec-tunnel-l2tp-psk if_stats /proc/net/dev/eth0 ; push ipsec-tunnel-l2tp-psk tunnel unknown ; push ipsec-tunnel-l2tp-psk phase1 unknown ; push ipsec-tunnel-l2tp-psk phase2 unknown nfmark me/him 4986003/4986003 The last two numbers are the SAref number (converted to the NFMARK numbers, so directly usable for iptables)
