OpenVPN Logs export on daily basis

kesaribabu

Hi everyone,

Is their any way to export OpenVPN logs on a daily basis for audit purpose???
If their is way or chance, let me know.

In order to track WFH user connections on a daily basis, i need all users authenticated information for every day. That is, i need to report like Day 1: These many users connected at these times , and day 2 ............

How can i get this information? Do we have any plugin/package to install to extract or export all vpn logs
or
can we have a cron job on a daily job????

jimp

Doing it daily would be unreliable. On pfSense versions before 2.5.0, the log is a binary circular log. As new log entries come, old ones are deleted. There are likely way more entries in a day than would fit in the log.

What you need is to setup an external syslog server and export the logs there from pfSense (Status > System Logs, Settings tab. Then your syslog server can keep them long-term and do whatever reporting you require.

kesaribabu

@jimp thank you, I'll do it as per your advice.

adamw

I'm reviving this topic since most users should now be using OpenVPN v 2.5.0+.

My pfSense+ v 23.05

Has anything been implemented to facilitate daily digest reports of OpenVPN activity?

Or maybe somebody put together a local script and a cronjob to do that and is willing to share?

Logwatch on Debian does it nicely e.g. for SSH:

--------------------- SSHD Begin ------------------------ 

Users logging in through sshd:
   user1:
      100.100.100.100 (100.100.100.100.example1.com): 1 Times
   user2:
      200.200.200.200 (pool-200-200-200-200.example2.com): 2 Times

**Unmatched Entries**
Accepted key RSA SHA256:16C1614BTTe/00F5kbD4DM59aNUpJ1vSVo+YQuqkWZE found at /etc/ssh/keys/user2.pub:1 : 2 Times
Accepted key RSA SHA256:fK15rjp7hNSuiOjZqDoekOpJYSkz0kIP57hmtduCTOI found at /etc/ssh/keys/user2.pub:1 : 4 Times
Read error from remote host 200.200.200.200 port 56326: Connection reset by peer : 1 Time
error: kex_exchange_identification: Connection closed by remote host : 288 Times

---------------------- SSHD End -------------------------

adamw

Any updates on this?

I would imagine most OpenVPN users wanting such tool to be included.

Personally I would really like to see daily statistics via email.

Similar to Logwatch in Linux which is easy to install and configure.

Gertjan

@adamw said in OpenVPN Logs export on daily basis:

Any updates on this?

4 steps :

This :

Allows you to setup periodic e-mail reports containing command output, and log file contents

looks like what you're asking for.

Never used it myself.

marcelobeckmann

@adamw If you export pfSense logs to a syslog server, you can start filtering information about connections and disconnections via:

grep -E 'Peer Connection Initiated|new connection by client|Inactivity timeout' openvpn.log

It's possible to make a shell script to parse the information to make a report and send by email.