log alert

Norvik IT

Hello Team,

i would like to know if there is any other way i can get alerts if a package has stopped running in pfsense, i need to know if there is any tool i can use to receive alerts in case any service stops.

bingo600

@norvik-it
I have enabled e-mail notification.
And use the "service watchdog" package , to restart any packages that "crashes"

I get an e-mail from service watchdog, when a service is stopped (restarted)

/Bingo

Norvik IT

@bingo600
thanks @bingo600 is there any apart from watchdog?

bingo600

@norvik-it

I have no idea

Gertjan

@bingo600 said in log alert:

to restart any packages that "crashes"

This is very IMHO : non conditional restarting of processes that crash gives you a free ticket to the next best level : the entire system will go down.
And that leaves the admin with the task to dig down in the pile of mess of finding the original core issue.
If a process tends just ones to crash, and I can't find the reason straight away, then I will stop using that process and all linked functionality.
I'll try to understand and repair if possible, later.

The thing is : I've seen thinks crashing during the last 10+ years.
It was always 'my fault', never (I know, never is a big word) it was 'pfSense'. I'm messing with my system a lot, the glue-ware, GUI ware, that is, rarely core or kernel stuff.
If core functionality fails, like routing, dns resolving, or DHCP, then pfSense will become unusable. That didn't happen up until now.

True, I'm not using a lot of pfSense add-on packages.

Norvik IT

@bingo600 i also see this notifications from watchdog coming every minute and i would want there frequency changed like 30 minutes time, is that possible or it has to be logging after every minute. the inbox is just flooded with notifications every 1 minute

Gertjan

@norvik-it said in log alert:

this notifications

What notification ?

Norvik IT

@gertjan

those notifications keep coming every minute

bingo600

@norvik-it
Don't use Service Watchdog for tasks that:

1: Cant start manually (ie. have issues)
2: Arent supposed to be Always Active

Gertjan

@norvik-it

Ah, ok, nice example of taking care of a sick person with a shotgun.

I use pfBlockerng-devel with dnsbl myself. It's web server doesn't "stop" like that every minute.
The PID is here (according to the info found in the pfBlockerng-devel lighty webserver config file here /var/unbound/pfb_dnsbl_lighty.conf ) : /var/run/dnsbl.pid

The process number is in that file : does it really stops every minute ?

All the others : SquidGuard, ntopng iperf ClamAV ICAP are part of the 'do not belong on a firewall anyway (my opinion).

I've installed this 'Service Watchdog' package and added a task :

Unselecting the notification box will stop sending you mails.
The issue is now a bit solved.

Next step : check if the service is really stopped.
And if so, why / by who / what reasons ?!

Example :

[22.05-RELEASE][admin@pfSense.xxxxx.net]/root: cat /var/run/dnsbl.pid
4622
[22.05-RELEASE][admin@pfSense.xxxxx.net]/root: ps ax | grep '4622'
 4622  -  S        0:00.02 /usr/local/sbin/lighttpd_pfb -f /var/unbound/pfb_dnsbl_lighty.conf
35843  1  S+       0:00.00 grep 4622

So the process running.

If all these process are really killed on your system every minute, I can advise you to do one thing :
Remove / disable all these packages.

Or, as stated above, find the reason why they are dying on your pfSense, or are getting killed.
Remove the issue for each of them.

Example : if free RAM gets low, the system will kill processes, this is known as the OOM (Out Of Memory) event. Restarting them in that case is a really bad idea.