external HDD for logs
-
Hello,
i have a netgate 5100 running and i am facing problems with disk space.
is there a manual how to install an external drive, where i can write logs etc?
i would like to run PFBlockerNG and ntopng, but i am facing severe space problems.
at the moment 88% of disk space used...regards,
gunther -
Hi,
I'm using myself a Syno NAS, and have set it up to accept "syslogs" from my pfSense.
Before that, I was using a 2008R2 Windows with the syslogger 'program 'Kiwi' (not sure if that still exists). The server was always on, so it worked well.
I never used this to offload the logs from my pfSEnse, but to have a "unllimited" backup of my logs, so, when something goes really wrong, I could find on the NAS what happened, without relying on my pfSense.@hebein said in external HDD for logs:
PFBlockerNG and ntopng
Be aware.
PFBlockerNG does not use the pfSense 'system' syslogger.
It stores it logs here :
and depending on your pfBlockerng settings, usage etc these files could be made smaller, or waaaay bigger.
It is possible to 'map' this location to an external drive, which you have to mount during system startup.I've been using pfBlockerng for years, and I know how much space it needs, normally, not that many Gbs, but when I receive people that really want to visit every possible DNSBL known on earth, logs can grow fast.
ntopng : now this is strange that you were not informed before.
A 8 Gbytes drive is ok for a pfSense 'firmware' and a couple of ZFS pare partitions - not for disk space 'destroyers' like ntopng.
I've waited and ordered this device : the 4100, the MAX version so I could try, ones in a while, a package like ntopng, as this is a package that produces a massive quantity of data == files.
So, I have more then 100 Gbytes in my pfSense just to be ready. The MAX has also an SSD and not just a less capable eMMC flash drive (rather limited life span, allergic for many write cycles).AFAIK : ntopng uses its own log file folder, not the system's syslog.
The good news : see this. Double, triple, fact check the type of drive you need, and get one.
If you know how to turn a screw driver (don't use an electric one as soon in the guide !), you'll be good.
Its even not needed to re install pfSense : you can mount the second M2SATA during boot (instruction are on the forum) or do what the guide says : install pfSense on it. -
You may have old ZFS BEs using disk space.
But you should install an m.2 SATA drive in the 5100 if you need to log a lot to it.
It's especially important on the 5100 because the eMMC failing due to drive writes can result it in not booting at all.Steve
