DNSBL to Syslog?
-
Is there a way I can get my DNSBL events into a syslog server? I know that they are not part of the pfSense syslog but is there an option in pfBlockerNG itself, or has someone developed a work around to ship them periodically with a cron job or something similar?
-
So I worked out the following kludge using Email Reports to get the job. Hopefully in a future release there will be a real time syslog facility for pfBlockerNG - as it is this only reports on yesterday's DNSBL.log entries. Also, it appears that the new python option does not log the source of the DNSBL log entry - you have to revert to the old Unbound to get that in your reports.
Using email reports, create a daily report to run at 1am with the following command:
date -v-1d '+%b %-d' | grep -f /dev/stdin /var/log/pfblockerng/dnsbl.log | awk -F'[,]' '{ print $2,"DNSBL:",$7,"List:",$9,"URL:",$3, "Source:",$4}' | while read -r line; do echo "$line" | nc -w0 -u syslog_server 514 ; done
-
Use the cron package.
