System logging to remote syslog-server stops working after reboot
marsboer last edited by
We successfully use pfSense (2.0-RC3 (i386) built on Sun Aug 21 17:58:22 EDT 2011) running on a ESXi-host but have a very annoying problem with sysloging.
We are required to log firewall-events and portal auth and it works OK as long as the settings were activated the current uptime-session.
But after a reboot the firewall-events stops logging to the remote server (works locally though) even though the Portal Auth logs keeps on logging to the syslog server like it should.
If i check "Everything" all logs work until reboot, after which all remote sysloging stops working, even the Portal Auth.
To fix this i have to go into the GUI and click on Save (all settings are remembered correctly between reboots), and then it immediately starts working again.
This is a big concern for our security guys, and it actually gave us problems when the logs for a detected attack could not be found on the syslog-server even though we verified that it worked when we set up the pfsense-server.