kb.hurricane-ridge.com

iptables -I OUTPUT -p tcp --dport 25 -o eth0 -j LOG --log-level info --log-prefix 'iptables smtp: '

If this is a defensive setting – monitoring for a host being used as a spam bot, for example – you may want to consider rate-limiting outbound SMTP traffic first, to prevent your log partition from being filled (and limit the damage done by a compromised host in the first place):

iptables -I OUTPUT -p tcp --dport 25 -o eth0 -m state --state NEW -m limit --limit 1/minute --limit-burst 2 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 25 -o eth0 -m state --state NEW -j DROP