Notification on events

[sandman42]

Hi,

I would like to receive notifications on events, such as user login, cpu and memory hog and so on.
I've set up email notifications.
When may I select events to be notified about?

I'm using pfSense 2.4.5 p1

Thanks

[Gertjan]

@sandman42 said in Notification on events:

When may I select events to be notified about?

When such a functionality is implemented, which isn't the case right now.
There are a few events that are signalled - these are hard-coded, like the update done, a reboot, and several NUT/UPS notification.

Way back, I asked myself the same question, and implemented this - it's a good old Munin, which permit to set thresholds, warnings and error conditions, and it can be set to send mails.
Munin needs a internal or external web server, a client part on pfSense, to be set up on pfSense (it's not a pfSense package) and a remote part - the "server".

Btw : as you can see, memory usage of a firewall/router is rather non relevant, as it's doing always the same thing all the time. Users aren't login, except the admin. I do have users logging in, but these are captive portal users - not really pfSense resources when they log in.

Not much is happing on a firewall. When set up initially, you should consult follow the logs the first days / weeks / months. When things are stable, you could check up some what less, let's say ones a week.
When you upgrade something, this procedure should be repeated : check regularly. And do what I do : read the graph stats which also can show a lot over time.

[serbus]

Hello!

The Munin program looks nice!

The pfsense mailreport package lets you build and schedule custom reports.

There are also scripts that you can use to hand-roll your own email notifications, like:

clog /var/log/system.log | grep -iE 'successful login | logged out | authentication error' | php /usr/local/bin/mail.php -s="My login report"

or

php /etc/rc.notify_message -em "Test notification"

I think there are also lots of siem tools out there that will do what you want.

John

[sandman42]

Thanks for the answer Gertjan

I'll have a look at it

Ciao