Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Remote Logging Issues

    Scheduled Pinned Locked Moved General pfSense Questions
    15 Posts 4 Posters 3.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      biggsy
      last edited by

      I updated the 2.1 (i386) machine to 2.1.2 yesterday and still no joy.

      At first I thought the <dhcp>was being left in the <syslog>section of the config when turning of DHCP logging but that turned out not to be the case.  Whether that is present or not, the remote syslog is still filling up with dhcpd entries.  Tried rebooting pfSense after changing the setting, still no change.

      Any ideas on where to start looking for the problem?</syslog></dhcp>

      1 Reply Last reply Reply Quote 0
      • P
        phil.davis
        last edited by

        I am on 2.2, so the problem might not be there. But look in /var/etc/syslog.conf, with DHCP remote syslog on, this file looks like:

        !radvd,routed,olsrd,zebra,ospfd,bgpd,miniupnpd
*.*								%/var/log/routing.log
!ntp,ntpd,ntpdate
*.*								%/var/log/ntpd.log
!ppp
*.*								%/var/log/ppp.log
!pptps
*.*								%/var/log/pptps.log
!poes
*.*								%/var/log/poes.log
!l2tps
*.*								%/var/log/l2tps.log
!charon
*.*								%/var/log/ipsec.log
!openvpn
*.*								%/var/log/openvpn.log
!apinger
*.*								%/var/log/gateways.log
!dnsmasq,filterdns,unbound
*.*								%/var/log/resolver.log
!dhcpd,dhcrelay,dhclient
*.*								%/var/log/dhcpd.log
!relayd
*.* 								%/var/log/relayd.log
!hostapd
*.* 								%/var/log/wireless.log
!-ntp,ntpd,ntpdate,charon,openvpn,pptps,poes,l2tps,relayd,hostapd,dnsmasq,filterdns,unbound,dhcpd,dhcrelay,dhclient,apinger,radvd,routed,olsrd,zebra,ospfd,bgpd,miniupnpd
local0.*							%/var/log/filter.log
local3.*							%/var/log/vpn.log
local4.*							%/var/log/portalauth.log
local7.*							%/var/log/dhcpd.log
*.notice;kern.debug;lpr.info;mail.crit;daemon.none;		%/var/log/system.log
news.err;local0.none;local3.none;local4.none;			%/var/log/system.log
local7.none							%/var/log/system.log
security.*							%/var/log/system.log
auth.info;authpriv.info;daemon.info				%/var/log/system.log
auth.info;authpriv.info 					|exec /usr/local/sbin/sshlockout_pf 15
*.emerg								*
local7.* 							@10.49.208.111

        The last line disappears when I uncheck "DHCP service events"
        Would be good to know if that is happening on 2.1.2 - that will help decide if there is a conf file processing issue, or something else.

        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

        1 Reply Last reply Reply Quote 0
        • P
          priller
          last edited by

          Looking at /var/etc/syslog.conf on 2.1.2,  there is no change to the dhcp services section when you toggle it off/on.  The remote syslog server is never removed.

          !dhcpd,dhcrelay,dhclient
*.*                                                             %/var/log/dhcpd.log
*.*                                                             @192.168.1.52

          I have tried editing the file and removing the line with the remote syslog server.  However, it keeps getting added back in when you toggle "Send log messages to remote syslog server" off/on, even with dhcp services  unchecked.

          –-

          EDIT:  Just tried this on 2.2 and the remote syslog server gets added to the dhcp services, even with it being unchecked.

          Bug filed: https://redmine.pfsense.org/issues/3613

          1 Reply Last reply Reply Quote 0
          • P
            phil.davis
            last edited by

            I just tried on a 2.1.2 system.

            *.*                                                             @192.168.1.52

            That type of line only comes when I have "Everything" checked.
            What exact things to you have checked/unchecked to get what you are reporting?
            And what sequence of actions?
            A screenshot would be helpful, so I can try to reproduce what you are seeing.

            As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
            If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

            1 Reply Last reply Reply Quote 0
            • P
              priller
              last edited by

              Very straight forward to reproduce.  I did this on a clean 2.2 VM install that never had remote syslog configured.

              Status: System logs: Settings

              • Check "Enable Remote Logging"
              • Add a server IP address to "Remote Syslog Servers"
              • Under "Remote Syslog Contents" just select "System Events", as an example.
              • Save

              Note: At no time did I ever select "Everything"

              When you view  var/etc/syslog.conf  the remote syslog server has been added to the dhcp services.

              !dhcpd,dhcrelay,dhclient
*.*                                                             %/var/log/dhcpd.log
*.*                                                             @192.168.1.52

              That  @192.168.1.52 entry should not be there unless you have "DHCP service events" ticked.

              I attached a screen shot (from my live 2.1.2 install).  DHCP is not selected, but it is getting configured for remote sysloging.

              syslog.jpg
              syslog.jpg_thumb

              1 Reply Last reply Reply Quote 0
              • B
                biggsy
                last edited by

                Same thing here.

                On my 2.1.2 system I can't enable DHCP Service Events.  "Everything" is not checked and there is no change to /var/etc/syslog.conf when toggling DHCP Service Events.

                
!dhcpd,dhcrelay,dhclient
*.*                                                             %/var/log/dhcpd.log

                On my friend's 2.1.2 system I can't disable DHCP Service Events.  Again, no change to /var/etc/syslog.conf when toggling and Everything is unchecked.

                
!dhcpd,dhcrelay,dhclient
*.*                                                             %/var/log/dhcpd.log
*.*                                                             @10.0.1.3
                1 Reply Last reply Reply Quote 0
                • P
                  phil.davis
                  last edited by

                  It is just an ordinary cut-and-paste bug in the code.
                  This fix for 2.1.2: https://github.com/pfsense/pfsense/pull/1119
                  And for master branch (to fix it in 2.2 onwards): https://github.com/pfsense/pfsense/pull/1118

                  As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                  If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                  1 Reply Last reply Reply Quote 0
                  • B
                    biggsy
                    last edited by

                    Thanks, Phil.

                    Can that just be edited in a running system or will it get over-written with a reboot?

                    1 Reply Last reply Reply Quote 0
                    • B
                      biggsy
                      last edited by

                      Just having a look at the system.inc on my machine.

                      Does the chunk of code immediately above that (DNS?) have the same problem?

                      2014-04-21_17-05-47.png
                      2014-04-21_17-05-47.png_thumb

                      1 Reply Last reply Reply Quote 0
                      • P
                        phil.davis
                        last edited by

                        Since it is a 1-liner, you could just make the edit direct on your system - Diagnostics->Edit, type in the file name, Load, findthe line, change it, press save - but don't stuff up otherwise your system will really be broken, since /etc/inc/system.inc is included by pretty much everything, if you introduce a syntax error then the whole webGUI will be broken, and PHP shutdown/reboot script…!!!

                        Otherwise wait until it is committed and use System Patches package to apply it. That way the edit is automated and there is a record on your system of what has been changed.

                        Yes, the DNS chunk of code has a similar problem. But there did not seem to actually be an option on the webGUI to turn on/off DNS "resolver" remote syslog. I couldn't work out what string was actually needed there. It might be a completely missing piece of webGUI functionality also. I made a note in the master commit about that so one of the devs can sort it out.

                        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                        1 Reply Last reply Reply Quote 0
                        • B
                          biggsy
                          last edited by

                          I used Filezilla and Notepad++.  Seems to have worked fine.  Now to stop the DHCP entries in friend's syslog.

                          Yeah, I noticed there was no GUI check box for that.  If it isn't broken…

                          Thanks again.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.