Using iptables, you can write network activity to the log file, that is, which data is sent to and from where it comes from.
sudo iptables -t filter -A FORWARD -s 192.168.1.0/24 -m tcp -p tcp --dport 80 -j LOG --log-prefix "iptables: "
That the information was written not in rsyslog a file, and separately, we will create a file:
sudo nano /etc/rsyslog.d/10-iptables.conf
And add the following to it:
:msg, contains, "iptables: " -/var/log/iptables.log & ~
To apply the changes, restart rsyslog:
sudo /etc/init.d/rsyslog reload
Done, the network activity specified in the first rule will be written to the file /var/log/iptables.log.
It is also desirable to configure logrotate to remove old logs, to save disk space.