Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Remote syslog not working

    General pfSense Questions
    2
    3
    1035
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      thhi last edited by

      Hi all,

      we have problems with "remote syslog" on our redundant firewall setup. Both firewalls are logging to two remote syslog servers, the primary syslog server (ELSA, syslog-ng) accepts logs on the default port 514 and the secondary (ELK, logstash) accepts logs an a custom port (5140).

      After booting the primary firewall only the "system" logs are send to both syslog servers - the firewalls logs are only locally logged. However logging in principal is working. We see logs on the remote syslog servers that the two firewalls are synchronizing (ang logs could be send with "logger").

      The problem vanishes by sending a "HUP" signal to the syslog server an the primary firewall.

      On the secondary (backup) firewall we don’t have these problems.

      We think we have found the reason for this behavior: We filter all outgoing traffic on the interface to our syslog servers (our MGMNT net) and explicit allow syslog traffic. If we remove the outgoing filter rules syslog is working after a reboot. So it is properly a "race" condition. The syslog service is started before the firewall rules are loaded and the traffic is blocked.

      Any suggestions? Should I open a bug report on redmine?

      Best regards

      1 Reply Last reply Reply Quote 0
      • T
        thhi last edited by

        I have finally found the cause of this problem - DNS ;)

        I have used an alias which contains the domain names of the syslog servers in the outgoing filter rule.
        However the domain names had to be resolved by the (primary) dns server - our primary firewall.
        I have replaced the domain names of the syslog servers with their ip adresses and the problem doesn't occur.

        I still think that this is a (minor) bug in pfsense.

        Remark: I have reproduced this behavior without the firewall failover scenario - just use an alias with a domain name (which has to be resolved by the dns resolver of the firewall) in outgoing filter rule for syslog traffic and block all other outgoing traffic from the firewall to this network.

        1 Reply Last reply Reply Quote 0
        • H
          hoyb last edited by

          I just wanted to say thank you to the OP. I was having problems with remote syslog along the same lines. I spent about 3 hours troubleshooting, and your solution eventually resolved my problem. I haven't set up the alias/rules you suggested yet, since setting the IP of the syslog server, rather than the hostname, worked perfectly and is good enough for me. Thank you for posting your solution!

          1 Reply Last reply Reply Quote 0
          • First post
            Last post

          Products

          • Platform Overview
          • TNSR
          • pfSense Plus
          • Appliances

          Services

          • Training
          • Professional Services

          Support

          • Subscription Plans
          • Contact Support
          • Product Lifecycle
          • Documentation

          News

          • Media Coverage
          • Press
          • Events

          Resources

          • Blog
          • FAQ
          • Find a Partner
          • Resource Library
          • Security Information

          Company

          • About Us
          • Careers
          • Partners
          • Contact Us
          • Legal
          Our Mission

          We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

          Subscribe to our Newsletter

          Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

          © 2021 Rubicon Communications, LLC | Privacy Policy