Syslog Not showing Devices added/deleted on Captive Portal

[velbon]

Dear All,
I am trying to find out from the syslog who is deleting devices from my captive portal. Please is there anyway to check because i have been looking around and i didn't some where that show for example that user A had delete device 00:11:22:33:44:55

[Gertjan]

@velbon said in Syslog Not showing Devices added/deleted on Captive Portal:

user A

That would be a user A that has the rights to login into pfSense and can actually visit the page where a MAC can be deleted.

When I visit this page, Services > Captive Portal > cpzone1 > MACs to add a MAC, I see this in the syslog (not the pfSense System log page, a real syslog )

04-24-2020	10:26:30	Local5.Info	pfsense	Apr 24 10:26:34 nginx: 2001:470:1f13:5c0:2::c6 - - [24/Apr/2020:10:26:34 +0200] "GET /services_captiveportal_mac_edit.php?zone=cpzone1&act=add HTTP/2.0" 200 6878 "https://pfsense.brit-hotel-fumel.net/services_captiveportal_mac.php?zone=cpzone1" "Mozilla/5.0 (Windows NT 6.1; rv:75.0) Gecko/20100101 Firefox/75.0"
04-24-2020	10:26:21	Local5.Info	pfsense	Apr 24 10:26:26 nginx: 2001:470:1f13:5c0:2::c6 - - [24/Apr/2020:10:26:26 +0200] "GET /services_captiveportal_mac.php?zone=cpzone1 HTTP/2.0" 200 6694 "https://pfsense.brit-hotel-fumel.net/services_captiveportal.php?zone=cpzone1" "Mozilla/5.0 (Windows NT 6.1; rv:75.0) Gecko/20100101 Firefox/75.0"

Btw : 2001:470:1f13:5c0:2::c6 is the IP of my PC. I was actually logged in etc ...
here :

Apr 24 10:26:11 	php-fpm 	31452 	/index.php: Successful login for user 'admin' from: 2001:470:1f13:5c0:2::c6 (Local Database)

edit : so, your captive portal can also user their access credentials to enter the pfSense GUI ???
Don't tell that that is true ....