Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.
-
Some log files are not updating, you may copy them if you "need" them, then reset the log file from the Status / System Logs / Settings tab
I would run a fsck from the Shell prompt or even better, redo a Fresh install then recover the config.
-
@RonpfS Re-installed the whole thing again and went back to known working configurations, even ones before the march 26th issue, and there are still no IP blocks showing up in the Report tab, nor the firewall logs. Maybe somehow something is getting borked in the install? I am installing through USB with "guided install"
-
@themadsalvi Did you format the partition ? There should not be any file from the older installation after a Fresh install before restoring the config.
Restoring the config also doesn't change /var/log files.
-
@RonpfS yes, I also had it use the whole drive, just in case(to make sure nothing would interfere). I even used a different drive(that never had pfsense installed) to take out the chance of the hard drive being the issue as well.
-
@themadsalvi So after the install, before restoring the config, you have no log files updating ? Even after a reboot ?
-
@RonpfS The log files have not updated since the fresh install was finished yesterday. very strange.
My only guess is that something in the config that is being restored is causing this to happen. Don't know how this could actually occur though, as mentioned before, I went with configs from 2018 where Pfblocker was actually blocking IP's.
-
Start over, check that logging occurs, then redo the config from scratch instead of restoring a config. Keep monitoring logging until you identify the culprit.
-
@RonpfS looks like that is indeed my only option here. I will have to wait until I can make a window for re-do/update in my environment.
-
@themadsalvi You could investigate your config.xml to check if something obvious might cause your problems.
-
@themadsalvi here is what I have on my side :
[2.4.4-RELEASE][2019-05-06 18:51:20][admin@pfsense.local]/var/log: ls -altr total 4195 drwx------ 2 www www 2 Oct 3 2018 lighttpd -rw-r--r-- 1 root wheel 161664 Dec 8 19:40 bsdinstall_log drwxr-xr-x 2 root wheel 2 Dec 8 19:42 ntp -rw-r--r-- 1 root wheel 0 Dec 8 19:46 lastlog drwx------ 3 root wheel 4 Dec 8 19:51 suricata drwxr-xr-x 26 root wheel 26 Dec 12 07:42 .. drwxr-xr-x 7 root wheel 30 Dec 12 07:42 . -rw------- 1 root wheel 10240000 Dec 20 21:14 vpn.log -rw------- 1 root wheel 10240000 Dec 20 21:14 poes.log -rw------- 1 root wheel 10240000 Dec 20 21:14 l2tps.log -rw------- 1 root wheel 10240000 Dec 20 21:14 openvpn.log -rw------- 1 root wheel 10240000 Dec 20 21:14 portalauth.log -rw------- 1 root wheel 10240000 Dec 20 21:14 ipsec.log -rw------- 1 root wheel 10240000 Dec 20 21:14 ppp.log -rw------- 1 root wheel 10240000 Dec 20 21:14 relayd.log -rw------- 1 root wheel 10240000 Dec 20 21:14 wireless.log -rw------- 1 root wheel 10240000 Dec 20 21:14 routing.log drwxr-xr-x 2 root wheel 4 Feb 25 17:03 nginx -rw-r--r-- 1 root wheel 11566 Feb 26 12:40 dmesg.boot -rw------- 1 root wheel 9252 Feb 26 12:40 userlog -rw------- 1 root wheel 10240000 Mar 29 12:40 ntpd.log -rw-r--r-- 1 root wheel 394 May 6 17:45 utx.lastlogin -rw------- 1 root wheel 11801 May 6 17:45 utx.log drwxr-xr-x 2 unbound unbound 12 May 6 18:19 pfblockerng -rw------- 1 root wheel 10240000 May 6 18:20 system.log -rw------- 1 root wheel 10240000 May 6 18:20 dhcpd.log -rw------- 1 root wheel 10240000 May 6 18:20 resolver.log -rw------- 1 root wheel 10240000 May 6 18:20 gateways.log -rw------- 1 root wheel 10240000 May 6 18:28 nginx.log -rw------- 1 root wheel 10240000 May 6 18:51 filter.logSo some files are updated, some are dated from the last install.
-
I'm new to using pfblocker and just had the same issue. I noticed you are using squid as i am also. pfblocker will not filter ip addresses while squid is enabled. I tested enabling and disabling it. I'm not sure what the better option is because i cant get pfblocker to filter https. so currently i'm just using pfblocker to filter dnsbl
