Notification on events
-
Hi,
I would like to receive notifications on events, such as user login, cpu and memory hog and so on.
I've set up email notifications.
When may I select events to be notified about?I'm using pfSense 2.4.5 p1
Thanks
-
@sandman42 said in Notification on events:
When may I select events to be notified about?
When such a functionality is implemented, which isn't the case right now.
There are a few events that are signalled - these are hard-coded, like the update done, a reboot, and several NUT/UPS notification.Way back, I asked myself the same question, and implemented this - it's a good old Munin, which permit to set thresholds, warnings and error conditions, and it can be set to send mails.
Munin needs a internal or external web server, a client part on pfSense, to be set up on pfSense (it's not a pfSense package) and a remote part - the "server".Btw : as you can see, memory usage of a firewall/router is rather non relevant, as it's doing always the same thing all the time. Users aren't login, except the admin. I do have users logging in, but these are captive portal users - not really pfSense resources when they log in.
Not much is happing on a firewall. When set up initially, you should consult follow the logs the first days / weeks / months. When things are stable, you could check up some what less, let's say ones a week.
When you upgrade something, this procedure should be repeated : check regularly. And do what I do : read the graph stats which also can show a lot over time. -
Hello!
The Munin program looks nice!
The pfsense mailreport package lets you build and schedule custom reports.
There are also scripts that you can use to hand-roll your own email notifications, like:
clog /var/log/system.log | grep -iE 'successful login | logged out | authentication error' | php /usr/local/bin/mail.php -s="My login report"
or
php /etc/rc.notify_message -em "Test notification"
I think there are also lots of siem tools out there that will do what you want.
John
-
Thanks for the answer Gertjan
I'll have a look at it
Ciao