Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Firewall Log every 7 minutes

    Firewalling
    6
    17
    12.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      Emab
      last edited by

      For example i actvate the log option in a firewall (allow) rule, but I never get this event logged, becouse if the event is not generated in the moment in which the log run, this in not logged…

      My log report event at interval...

      This happen only with the latest beta...

      Any idea to check and correct this problem?

      1 Reply Last reply Reply Quote 0
      • S
        sullrich
        last edited by

        Please try http://www.pfsense.com/~sullrich/1.0-BETA1-TESTING-SNAPSHOT-1-25-06/

        Also, turn on raw logs to make sure its not appearing there and not in the normal firewall logs screen.

        1 Reply Last reply Reply Quote 0
        • E
          Emab
          last edited by

          @sullrich:

          Please try http://www.pfsense.com/~sullrich/1.0-BETA1-TESTING-SNAPSHOT-1-25-06/

          Also, turn on raw logs to make sure its not appearing there and not in the normal firewall logs screen.

          I do the upgrade to this version…
          ...and now no firewall log. Nothing is logged :(

          1 Reply Last reply Reply Quote 0
          • E
            Emab
            last edited by

            Now something appear:

            Last 100 firewall log entries
Act 	Time 	If 	Source 	Destination 	Proto
	Jan 27 00:51:52 	NG0 	198.104.137.161:48170 	xx.xx.xxx.xxx:1027 	UDP
	Jan 27 00:51:52 	NG0 	198.104.137.161:48170 	xx.xx.xxx.xxx:1026 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	82.54.140.92:3348 	xx.xx.xxx.xxx:139 	TCP
	Jan 27 00:51:52 	NG0 	82.54.140.92:2983 	xx.xx.xxx.xxx:139 	TCP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	135.94.139.51:0 	xx.xx.xxx.xxx:1025 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	41.133.149.19:0 	xx.xx.xxx.xxx:1025 	UDP
	Jan 27 00:51:52 	NG0 	41.133.149.19:0 	xx.xx.xxx.xxx:1026 	UDP
	Jan 27 00:51:52 	NG0 	202.99.172.172:43678 	xx.xx.xxx.xxx:4073 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	82.54.140.92:3286 	xx.xx.xxx.xxx:445 	TCP
	Jan 27 00:51:52 	NG0 	82.54.140.92:3286 	xx.xx.xxx.xxx:445 	TCP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	82.54.79.230:1561 	xx.xx.xxx.xxx:445 	TCP
	Jan 27 00:51:52 	NG0 	82.54.79.230:1561 	xx.xx.xxx.xxx:445 	TCP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	61.156.42.117:38680 	xx.xx.xxx.xxx:4257 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP
	Jan 27 00:51:52 	NG0 	29.72.169.211:0 	xx.xx.xxx.xxx:1026 	UDP
	Jan 27 00:51:52 	NG0 	86.144.214.23:2814 	xx.xx.xxx.xxx:61504 	UDP
	Jan 27 00:51:52 	NG0 	192.168.100.1 	224.0.0.1 	IGMP

            But is impossible that all the events happen in the same second and no other event before and after.
            And Nothing was logged if in a rule I set to log…

            1 Reply Last reply Reply Quote 0
            • K
              kikawala
              last edited by

              I'm on the 1-25-06 snapshot and am also experiencing this issue.  Even when I set it to show raw logs and also when I log to a remote syslog server.  It seems as if the logs are being buffered and then being dumped at once with the same timestamp…

              I've attached part of my syslog if it helps any.

              syslog.pfsense.txt

              1 Reply Last reply Reply Quote 0
              • J
                jeroen234
                last edited by

                you got more on the firewall tab than i get
                on the system tab i see that that the firewall has problemes
                also al the way to the right of the pfsense logo in the upper corner i see [object window]

                this is on my system tab:
                Jan 27 07:24:04 mpd: [pt0] link: DOWN event
                Jan 27 07:24:04 mpd: [pt0] LCP: Down event
                Jan 27 07:25:17 syslogd: exiting on signal 15
                Jan 27 07:25:18 syslogd: kernel boot file is /boot/kernel/kernel
                Jan 27 07:25:23 php: : There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:

                config-pfsense.local-20060127073231.xml.txt
                rules.debug.txt

                1 Reply Last reply Reply Quote 0
                • S
                  sullrich
                  last edited by

                  There were error(s) loading the rules: pfctl: DIOCSETSTATUSIF - The line in question reads [ DIOCSETSTATUSIF]:

                  The above means that you have assigned an interface that is not present.

                  Re-assign you're interfaces (including VLANs)

                  1 Reply Last reply Reply Quote 0
                  • E
                    Emab
                    last edited by

                    So….no news?

                    I upfate to version: 1.0-BETA1-TESTING-SNAPSHOT-1-28-06
                    built on Sun Jan 29 05:44:39 UTC 2006

                    but Firewall logs still run at interval…

                    Can I do some test to help you to find a solution?

                    1 Reply Last reply Reply Quote 0
                    • S
                      sullrich
                      last edited by

                      Yes, we are aware of some issues.

                      1 Reply Last reply Reply Quote 0
                      • E
                        Emab
                        last edited by

                        Ok… I wait...

                        Thank!!

                        Let me know if you need any test...

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post