PfSense syslog and ELSA

jimp

Did you enable the option in the system log settings after applying the patch? It doesn't default to on.

A Former User

@jimp:

Did you enable the option in the system log settings after applying the patch? It doesn't default to on.

Knew I would brainfart at some point today. Forgot about that setting, will try when I get back and report back.

Tested after upgrading to 2.1.2 and working as expected after enabling it in the settings. Thank you

miloman

@jimp:

Try this one:

http://files.pfsense.org/jimp/patches/pf-log-oneline-option-2.1.1.diff

any love for pfsense 2.1.2 and 2.1.3?

biggsy

That patch works for me on 2.1.3.

BBcan177

I have had some issues with this patch also. Worked on most machines but one of them I had to remove the patch, reboot and then re-enable the patch to get it to work?

ozzbrian

Does this work for 2.5

valshare

don´t work with pfsense 2.2

jimp

The patch is not needed on 2.2.

2.2 changed the native log format to be one line already: https://doc.pfsense.org/index.php/Filter_Log_Format_for_pfSense_2.2

fearnothing

Hi folks, I'm looking into teach myself how to write a syslog-ng parser for pfsense 2.2 output. There are a few fields where I want to query exactly what content might be in them because the documentation page isn't quite specific enough. If someone's already written a parser - great! I'll look at it after I've taught myself to do it first, and maybe learn if I've made any mistakes. But the learning comes first :D

Specifically, I need to know what I might encounter in the following fields:

IP Flags - will it simply be "DNF" or "MF" or could it be more complicated?
ECN - is it going to give the numeric value or a text representation?
URG - will it say "set" or "true" or "urg" or something else?

fearnothing

Further to the above, I'm making good progress with the basic version of pfsense 2.2 firewall syslog events - just about have all IPv4 TCP/UDP working and will start on ICMP and IPv6 after that. One thing I don't have the facility to do at home is CARP, so I would very much appreciate it if people could post me some example CARP event messages for me to make sure my patterns are matching correctly.