Syslog remote logging problem after reboot

athurdent · Feb 5, 2013, 9:51 AM

Hmm, then you might be facing a different problem or my first entry is unrelated to remote syslogging. I always get:

syslogd: sendto: Network is unreachable

Ocid · Feb 5, 2013, 11:02 AM

Yes, it's something diffrent, because now my test server is sending events to remote syslog.

Last events from this server before today were at 2013-01-25 10:55:43, so after that time I might have abused my test server too much…

elgo · Feb 11, 2013, 3:45 PM

Hi,

I have the same problem with 2.1 (02 feb build).
My syslog server is directly attached to a static NIC of the pfsense box, not using IPv6 but it's not globally disabled. WAN link is pppoe though, if that matter.

After a fresh reboot of the pfsense box:

nothing on syslog server.
if I do some modification on the pfsense syslog parameters page and click on save, I get in remote syslog:

Feb  8 17:04:02 192.168.10.254 syslogd: restart
Feb  8 17:04:02 192.168.10.254 syslogd: kernel boot file is /boot/kernel/kernel
Feb  8 17:04:02 192.168.10.254 kernel: pflog0: promiscuous mode disabled
Feb  8 17:04:02 192.168.10.254 pf:

if I go into a shell on pfsense box, stop syslogd process and restart it, issue is fixed.

Additionnal data:

Seeing the "syslogd: sendto: Network is unreachable" message in pfsense logs.
no package installed
Config:

        <syslog><nentries>50</nentries>
                <logall><remoteserver>192.168.10.1</remoteserver>
                <remoteserver2><remoteserver3><enable><reverse><nologdefaultblock></nologdefaultblock></reverse></enable></remoteserver3></remoteserver2></logall></syslog>

jimp · Feb 11, 2013, 7:24 PM

Try editing this file on your firewall and remove the if statement and closing bracket, so it just runs system_syslogd_start(); no matter what.
See if that helps.

athurdent · Feb 12, 2013, 6:27 AM

Hi jimp,
which file should we edit?

jimp · Feb 12, 2013, 1:28 PM

Whoops there should have been a link in there.

http://redmine.pfsense.org/projects/pfsense/repository/revisions/25ed9cf8a4c1bd4155ee4e1881821b9e10501916/diff/etc/rc.bootup

athurdent · Feb 12, 2013, 3:13 PM

Fine, that works for me.

jimp · Feb 12, 2013, 4:30 PM

So that change fixes the problem?

Or you're OK with testing the change?

athurdent · Feb 12, 2013, 5:11 PM

Oh, sorry! I meant to say, the change worked for my setup (ALIX Board), it fixes the problem. And thanks for looking into this!

jimp · Feb 12, 2013, 5:22 PM

OK, I took the if statement out and updated the comment. Should be in later snapshots.

abrooks · Apr 26, 2013, 9:27 PM

I've got the same problem with 2.0.3, presumably I could try the same fix? Thanks, Adrian

jimp · Apr 29, 2013, 5:44 PM

@abrooks:

I've got the same problem with 2.0.3, presumably I could try the same fix? Thanks, Adrian

Yes if the same test/code is there on 2.0.x then the same fix should work.

abrooks · Apr 30, 2013, 7:31 PM

Thanks - I'll give it a try in a couple of days and let you know. Adrian.