Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall Log every 7 minutes

    Scheduled Pinned Locked Moved Firewalling
    17 Posts 6 Posters 12.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E Offline
      Emab
      last edited by

      @cmb:

      @billm:

      This might be pfsync, it's a little odd though seeing that on ng0.  I'm guessing something else unknown - no idea what 192.168.100.1 is, is that on your network?

      my guess would be some sort of routing protocol or failover in use by the ISP that's spewing out crap to customers where it probably shouldn't be.

      My problem is not the traffic logged…but the traffic that wan't logged.... as I told in my previous post...

      What I can do?
      I haven't this beaviour before...

      1 Reply Last reply Reply Quote 0
      • E Offline
        Emab
        last edited by

        For example i actvate the log option in a firewall (allow) rule, but I never get this event logged, becouse if the event is not generated in the moment in which the log run, this in not logged…

        My log report event at interval...

        This happen only with the latest beta...

        Any idea to check and correct this problem?

        1 Reply Last reply Reply Quote 0
        • S Offline
          sullrich
          last edited by

          Please try http://www.pfsense.com/~sullrich/1.0-BETA1-TESTING-SNAPSHOT-1-25-06/

          Also, turn on raw logs to make sure its not appearing there and not in the normal firewall logs screen.

          1 Reply Last reply Reply Quote 0
          • E Offline
            Emab
            last edited by

            @sullrich:

            Please try http://www.pfsense.com/~sullrich/1.0-BETA1-TESTING-SNAPSHOT-1-25-06/

            Also, turn on raw logs to make sure its not appearing there and not in the normal firewall logs screen.

            I do the upgrade to this version…
            ...and now no firewall log. Nothing is logged :(

            1 Reply Last reply Reply Quote 0
            • E Offline
              Emab
              last edited by

              Now something appear:

              Last 100 firewall log entries
Act 	Time 	If 	Source 	Destination 	Proto
	Jan 27 00:51:52 	NG0 	198.104.137.161:48170 	xx.xx.xxx.xxx:1027 	UDP
	Jan 27 00:51:52 	NG0 	198.104.137.161:48170 	xx.xx.xxx.xxx:1026 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	82.54.140.92:3348 	xx.xx.xxx.xxx:139 	TCP
	Jan 27 00:51:52 	NG0 	82.54.140.92:2983 	xx.xx.xxx.xxx:139 	TCP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	135.94.139.51:0 	xx.xx.xxx.xxx:1025 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	41.133.149.19:0 	xx.xx.xxx.xxx:1025 	UDP
	Jan 27 00:51:52 	NG0 	41.133.149.19:0 	xx.xx.xxx.xxx:1026 	UDP
	Jan 27 00:51:52 	NG0 	202.99.172.172:43678 	xx.xx.xxx.xxx:4073 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	82.54.140.92:3286 	xx.xx.xxx.xxx:445 	TCP
	Jan 27 00:51:52 	NG0 	82.54.140.92:3286 	xx.xx.xxx.xxx:445 	TCP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	82.54.79.230:1561 	xx.xx.xxx.xxx:445 	TCP
	Jan 27 00:51:52 	NG0 	82.54.79.230:1561 	xx.xx.xxx.xxx:445 	TCP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	61.156.42.117:38680 	xx.xx.xxx.xxx:4257 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	29.72.169.211:0 	xx.xx.xxx.xxx:1026 	UDP
	Jan 27 00:51:52 	NG0 	86.144.214.23:2814 	xx.xx.xxx.xxx:61504 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP

              But is impossible that all the events happen in the same second and no other event before and after.
              And Nothing was logged if in a rule I set to log…

              1 Reply Last reply Reply Quote 0
              • K Offline
                kikawala
                last edited by

                I'm on the 1-25-06 snapshot and am also experiencing this issue.  Even when I set it to show raw logs and also when I log to a remote syslog server.  It seems as if the logs are being buffered and then being dumped at once with the same timestamp…

                I've attached part of my syslog if it helps any.

                syslog.pfsense.txt

                1 Reply Last reply Reply Quote 0
                • J Offline
                  jeroen234
                  last edited by

                  you got more on the firewall tab than i get
                  on the system tab i see that that the firewall has problemes
                  also al the way to the right of the pfsense logo in the upper corner i see [object window]

                  this is on my system tab:
                  Jan 27 07:24:04 mpd: [pt0] link: DOWN event
                  Jan 27 07:24:04 mpd: [pt0] LCP: Down event
                  Jan 27 07:25:17 syslogd: exiting on signal 15
                  Jan 27 07:25:18 syslogd: kernel boot file is /boot/kernel/kernel
                  Jan 27 07:25:23 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:

                  config-pfsense.local-20060127073231.xml.txt
                  rules.debug.txt

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    sullrich
                    last edited by

                    There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:

                    The above means that you have assigned an interface that is not present.

                    Re-assign you're interfaces (including VLANs)

                    1 Reply Last reply Reply Quote 0
                    • E Offline
                      Emab
                      last edited by

                      So….no news?

                      I upfate to version: 1.0-BETA1-TESTING-SNAPSHOT-1-28-06
                      built on Sun Jan 29 05:44:39 UTC 2006

                      but Firewall logs still run at interval…

                      Can I do some test to help you to find a solution?

                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        sullrich
                        last edited by

                        Yes, we are aware of some issues.

                        1 Reply Last reply Reply Quote 0
                        • E Offline
                          Emab
                          last edited by

                          Ok… I wait...

                          Thank!!

                          Let me know if you need any test...

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.