PfSense - logging makes no sense



  • I'm reposting as this was moved by mods, probably it is not comfortable issue for devs.

    This is unbelievable that in product developed for so many years we can't get decent logging. In Pfsense there is no way to tell witch rule matched which event, we just get some ID which we can't even refer to it as it is nowhere to be seen even on GUI. The rule name in any decent firewall like Checkpoint or PA is always visible in events. This is just very basic stuff. Do we have to write down all IDs and guess which rule it was, and then write it down on paper? This is ridiculous, I hope developers will do something about it, it is just blocking factor to use this firewall for any customer.

    Do you think looking at logs through the pfSense GUI is really useful for more than 5-users installation? I'm talking about logs which are stored or forwarded from firewall. It is not possible to get any decent logging or information from pfSense on tools such Splunk or Arcsight. Corporations that require proper monitoring of firewalls just can't consider pfCrap as solution for firewall - just because log system is pure crap. HTTP GUI is just a toy.

    I hope developers can see this and do something about it, this is ridiculous not to have proper logging in any firewall, even most simple.


  • Banned

    Dude, you already have one trolling thread - https://forum.pfsense.org/index.php?topic=122678.0

    GTFO.



  • This is trolling because…? You really don't see how pfSense is limited in terms of logging capabilities? Have you ever worked with any firewall where you basically can't forward logs with rule name? Now you can use this firewall only at home or in "enterprise" which don't give a fuck about monitoring. I have yet to hear if anyone succeed with connecting pfSense to any decent logging system like Arcsight or Splunk. Any commercial firewall can do it with no problem, but not pfSense.



  • When you o use the search of this forum,
    You'll find people using splunk/elkstack just fine.

    If you prefer other firewall solutions, that is fine…

    No clue why you seem to enjoy spreading false information. Perhaps you could spend your time by doing something that is remotely useful?



  • I already search for this issue, and I haven't see so far anyone who could get firewalls log forwarded together with rule name / description. Of course you can forward raw log from pfSense, but this log is quite useless for T/S. You just see that something was blocked, but you can't see which rule blocked it. So still - this firewall lacks basic logging functionality, not because of lag of connector, but it just can't provide most simple information - which rule triggered the event.


  • Banned

    You are asking why's this trolling? Let me quote some your "helpful" remarks:

    @lutel:

    This is completely crap
    Another logging crap.
    And logs of PFSense are bullshit.
    pfCrap is like 20 years behind them.
    just can't consider pfCrap as solution for firewall - just because log system is pure crap. HTTP GUI is just a toy.
    this is ridiculous not to have proper logging in any firewall, even most simple.

    @lutel:

    It is not possible to get any decent logging or information from pfSense

    Of course not…

    Enough time wasted with you.



  • Great, beautiful charts, but have you got any MEANINGFUL information - like which rule (name) blocked any traffic? Of course you can draw pretty charts with geoip, so what? This firewall is not ready for enterprise - at least for one who cares about monitoring and have lots of firewall to manage.


  • Banned

    Dude, run

    
    pfctl -vvsr | grep label
    
    

    grab the IDs and labels, import them to whatever enterprise nonsense since you cannot decipher what blocked what, and after you are finished, get lost. We already got your point that you cannot live without descriptions.



  • This firewall is not ready for enterprise

    OK, so now that you have made this determination for yourself, this is the last we should expect to see of you?


  • Netgate

    It would be nice if the system maybe logged the rules that are loaded into the filter so the firewall generating them and the trackers could be matched up in a log aggregator.

    As it is it is not THAT hard to match up the rule that generated the log but you need to go to the firewall to do it. Far from impossible.

    Timestamp full_message pf_tracker
    2016-12-15 19:33:35.000 1419131430
    filterlog: 217,16777216,,1419131430,igb1,match,block,out,4,0x10,,128,62814,0,none,17,udp,328,198.51.100.226,172.16.141.114,68,67,308

    Shell Output - pfctl -vvsr | grep -a2 1419131430

    [ Evaluations: 41920820  Packets: 625      Bytes: 122335      States: 0    ]
      [ Inserted: pid 69284 State Creations: 0    ]
    @217(1419131430) block return out log quick on WANS inet from any to unroutablev4:9label "USER_RULE: Block egress to UNROUTABLE"
      [ Evaluations: 41251689  Packets: 225965    Bytes: 44854695    States: 0    ]
      [ Inserted: pid 69284 State Creations: 0    ]

    OP do you really think the best way to get your point across is to be so caustic?</unroutablev4:9>



  • Yes you can lick your balls, but i don't know how is it going to make this firewall better or useable in the future. You can say it has perfect logging, but in fact it lacks most basic capabilities - like sending in log stream rule names, log on session start/end. Have you ever heard about Firemon? It supports ANY decent firewall, but obviously it can't support pfSense - just because it can't provide any basic information on rule changes. So policy monitoring is also non-existing in the pfCrap. Lick your balls and thing of how great pfCrap is - but in fact it is just toy. Look at Firemon, this is serious security auditing tool for firewalls, you probably never heard of it.


  • Banned

    As predicted, nothing useful comes out of similar threads. Please, don't waste any more of your precious seconds with pfSense, noone's forcing you to use it.



  • @Derelict:

    OP do you really think the best way to get your point across is to be so caustic?

    Sorry for this i'm disappointed and annoyed that otherwise such a good firewall lacks so basic functionality, and no one can't event put it on some "wish list". I just would like devs to realize how much it is needed.


  • Banned

    If your wishlist inclusion requests look like

    @lutel:

    Lick your balls and thing of how great pfCrap is - but in fact it is just toy.

    then it's extremely surprising noone is willing to listen to your wishes.

    ::) ::) ::)



  • @doktornotor:

    If your wishlist inclusion requests look like

    @lutel:

    Lick your balls and thing of how great pfCrap is - but in fact it is just toy.

    then it's extremely surprising noone is willing to listen to your wishes.

    ::) ::) ::)

    Is there any place where i can praise the great pfSense firewall and tell that i just can't expect anything more from such a great and complete firewall?


  • Banned

    Maybe if you asked "Is there any way I can get firewall rules hits logged with descriptions on a remote syslog server so that I can find the problems more easily", you'd perhaps get a reasonable debate and suggestions. Meanwhile, you've managed to piss everyone off, so good luck with your requests.

    And of course, the absolutely top priority with firewalls is exporting non-unique, often non-descriptive user comments into remote syslog. That's #1 to consider when choosing a firewall solution.



  • @doktornotor:

    And of course, the absolutely top priority with firewalls is exporting non-unique, often non-descriptive user comments into remote syslog. That's #1 to consider when choosing a firewall solution.

    Missed you Dok. :)


Locked