Syslog-ng DHCP Hostnames
-
So, we have several firewalls, running 2.5.1 and 2.4.5
All our logs are sent from the firewalls to a Ubuntu VM, that runs syslog-ng.
Some of the interfaces on each firewall runs DHCP. When I run thru the logs, SOME logs shows the hostname of the system, most logs DO NOT. Is there a setting somewhere in PFSense that can adjust this? We want EVERY DHCP log to basically show the hostname of the system.
Here is an example of the ones that shows the hostname in brackets:
Aug 2 00:01:52 10.200.x.x dhcpd[35638]: DHCPACK on 10.x.x.x to 00:08:5d:2f:6b:04 (57i00085D2F6B04) via vmx4
Aug 2 00:02:41 10.200.x.x dhcpd[40742]: DHCPACK on 10.x.x.x to 70:38:ee:cb:0f:42 (konftel300ip) via vmx4From the same Firewall, without the hostnames:
Aug 2 00:01:52 10.200.x.x dhcpd[40742]: DHCPACK on 10.x.x.x to f8:b4:6a:e0:29:10 via vmx7
Aug 2 00:01:24 10.200.x.x dhcpd[40742]: DHCPACK on 10.x.x.x to 04:0e:3c:e3:d6:41 via vmx7 -
Check this file : /var/dhcpd/var/db/dhcpd.leases
It's the scratch-pad of the DHCP server(s) you have running on pfSense.You'll discover something : not every host informs the DHCP server its host name.
Or something awkward like "57i00085D2F6B04".If you do some research, you will probably discover this option :
on the Services > DNS Resolver > General Settings page.
You'll say : "Oh boy, this is what I need".I strongly advise you not to check this option.
It might take some time, but I advise you to add "static DHCP MAC entries" for every device you want to know by (DNS) name.
No "help me" PM's please. Use the forum, the community will thank you.
Edit : and where are the logs ?? -
Yes, there's no setting I'm aware of to force that.
You might be able to refuse leases to systems that don't supply a hostname but you probably don't want that.
Steve
-
@gertjan Thank you VERY much for your assistance.
