Notification on events

sandman42

Hi,

I would like to receive notifications on events, such as user login, cpu and memory hog and so on.
I've set up email notifications.
When may I select events to be notified about?

I'm using pfSense 2.4.5 p1

Thanks

Gertjan

@sandman42 said in Notification on events:

When may I select events to be notified about?

When such a functionality is implemented, which isn't the case right now.
There are a few events that are signalled - these are hard-coded, like the update done, a reboot, and several NUT/UPS notification.

Way back, I asked myself the same question, and implemented this - it's a good old Munin, which permit to set thresholds, warnings and error conditions, and it can be set to send mails.
Munin needs a internal or external web server, a client part on pfSense, to be set up on pfSense (it's not a pfSense package) and a remote part - the "server".

Btw : as you can see, memory usage of a firewall/router is rather non relevant, as it's doing always the same thing all the time. Users aren't login, except the admin. I do have users logging in, but these are captive portal users - not really pfSense resources when they log in.

Not much is happing on a firewall. When set up initially, you should consult follow the logs the first days / weeks / months. When things are stable, you could check up some what less, let's say ones a week.
When you upgrade something, this procedure should be repeated : check regularly. And do what I do : read the graph stats which also can show a lot over time.

serbus

Hello!

The Munin program looks nice!

The pfsense mailreport package lets you build and schedule custom reports.

There are also scripts that you can use to hand-roll your own email notifications, like:

clog /var/log/system.log | grep -iE 'successful login | logged out | authentication error' | php /usr/local/bin/mail.php -s="My login report"

or

php /etc/rc.notify_message -em "Test notification"

I think there are also lots of siem tools out there that will do what you want.

John

sandman42

Thanks for the answer Gertjan

I'll have a look at it

Ciao