Syslog remote logging problem after reboot

Ocid

Yes, it's something diffrent, because now my test server is sending events to remote syslog.

Last events from this server before today were at 2013-01-25 10:55:43, so after that time I might have abused my test server too much…

elgo

Hi,

I have the same problem with 2.1 (02 feb build).
My syslog server is directly attached to a static NIC of the pfsense box, not using IPv6 but it's not globally disabled. WAN link is pppoe though, if that matter.

After a fresh reboot of the pfsense box:

nothing on syslog server.
if I do some modification on the pfsense syslog parameters page and click on save, I get in remote syslog:

Feb  8 17:04:02 192.168.10.254 syslogd: restart
Feb  8 17:04:02 192.168.10.254 syslogd: kernel boot file is /boot/kernel/kernel
Feb  8 17:04:02 192.168.10.254 kernel: pflog0: promiscuous mode disabled
Feb  8 17:04:02 192.168.10.254 pf:

if I go into a shell on pfsense box, stop syslogd process and restart it, issue is fixed.

Additionnal data:

Seeing the "syslogd: sendto: Network is unreachable" message in pfsense logs.
no package installed
Config:

        <syslog><nentries>50</nentries>
                <logall><remoteserver>192.168.10.1</remoteserver>
                <remoteserver2><remoteserver3><enable><reverse><nologdefaultblock></nologdefaultblock></reverse></enable></remoteserver3></remoteserver2></logall></syslog>

jimp

Try editing this file on your firewall and remove the if statement and closing bracket, so it just runs system_syslogd_start(); no matter what.
See if that helps.

athurdent

Hi jimp,
which file should we edit?

jimp

Whoops there should have been a link in there.

http://redmine.pfsense.org/projects/pfsense/repository/revisions/25ed9cf8a4c1bd4155ee4e1881821b9e10501916/diff/etc/rc.bootup

athurdent

Fine, that works for me.

jimp

So that change fixes the problem?

Or you're OK with testing the change?

athurdent

Oh, sorry! I meant to say, the change worked for my setup (ALIX Board), it fixes the problem. And thanks for looking into this!

jimp

OK, I took the if statement out and updated the comment. Should be in later snapshots.

abrooks

I've got the same problem with 2.0.3, presumably I could try the same fix? Thanks, Adrian

jimp

@abrooks:

I've got the same problem with 2.0.3, presumably I could try the same fix? Thanks, Adrian

Yes if the same test/code is there on 2.0.x then the same fix should work.

abrooks

Thanks - I'll give it a try in a couple of days and let you know. Adrian.