SYSLOG FORMAT

[TheBoBobDude]

We have a PRTG server with syslog probes. Our ASA sends syslogs to it, and they are readable. The PFSense sends raw data that while we can figure out what it is saying, it is not in a format that is very useful.

Amount of effort on the Cisco to make them readable : Zero. Came out pretty the first try.

PFSense? We are struggling to get them readable.

Anybody get PRTG and PFSense to play nice together for syslog functionality?

[stephenw10]

In 2.6/22.01 you can change the log format if you need to:
https://docs.netgate.com/pfsense/en/latest/monitoring/logs/settings.html#global-log-settings

Have you tried both? Which are you using now?

Steve

[TheBoBobDude]

@stephenw10 Yes, we have tried BSD and Syslog settings.

It seems like the data needs to be filtered before being displayed, but it isn't.

PFsense log entry:

11,,,1000000107,ixl1.120,match,pass,in,6,0x00,0x00000,255,ICMPv6,58,24,9999:999:9007:200:ffff:ffff:ffff:150,9999:999:9007:200::3,

I did rewrite 7 digits with 9s to mask an IP addresses.
But this format isn't pretty to look at.

ASA log entry:

Mar 09 2022 08:22:14: %ASA-6-302016: Teardown UDP connection 58048835 for outside:8.8.8.8/53 to DMZ:172.16.1.23/36743 duration 0:00:00 bytes 174

I can totally read that without any effort.

[stephenw10]

The filter log format is described here: https://docs.netgate.com/pfsense/en/latest/monitoring/logs/raw-filter-format.html
I'm not sure what sort of capability PRTG offers to parse that structure though.

Steve