Using syslog-ng to filter for critical events and send alert email

[peterglock]

I've put together a reasonably simple use case for raising an alert when a log message with a particular tag is send from a remote endpoint (in this case a raspberry Pi). Any suggestions for how to improve or extend this will be most welcome.

1. Create a program for interfacing with the mail.php function of pfSense

• SSH as admin to your pfSense instance and open a new file '/usr/local/sbin/sendalert.sh' (I have nano on my pfSense but vi works just as well)

• Insert the following text:

#!/bin/sh
sendmail="/usr/local/bin/mail.php"
subject="Alert from pfSense ${HOST}"
             
while true ; do
        while read line ; do
        echo $line | $sendmail -s"$subject"
        done
done

Note: the program will only quit when syslog-ng terminates it (see 7.17. program: Sending messages to external applications in guide for version 3.14)

• Save the file and make it executable

chmod a+x /usr/local/sbin/sendalert.sh

2. From the pfSense GUI, install the package 'syslog-ng'
3. Once installed, go to 'Services > syslog-ng'

• list itemOn the 'General' tab, configure the interfaces you want to receive logs on (probably LAN and VPN) and the port number

• list itemGo to the 'Advanced' tab and add the following:

4. Configure your remote system to send logs to your pfSense instance using the port configured in step 3 you should see them appear on the 'Services > Syslog-ng > log viewer' tab.

5. Test by generating a log entry on your remote system.

echo "[CRITICAL] This is a text message" | logger -p local3.crit

After a few minutes you should receive an email at the address configured under 'System > Advanced > Notifications'

In this example the tag is "CRITICAL". You could also use the level of the message for your filter e.g.

{ message ("CRITICAL") or level(crit..emerg)};

would filter for the word CRITICAL or the level being critical or higher (see 8.4.6. Filter functions in in guide for version 3.14)

[daisychain]

Hi peterglock! Very interesting post. Unfortunately your instructions to do in the "Advanced tab" are not longer available in the post (or at least I cannot see them). Can you please, share them again? thanks a lot!