Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Syslog'ing to remote syslog server

    General pfSense Questions
    4
    6
    7579
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Stoutman last edited by

      I am trying to get pfsense configured in order to replace our sonicwall here at work. pfselse looks like it will do quite a few more things for us, such as dual-wan and failover. I have these set up and they appear to be working just fine.

      However, I am trying to learn how to set up pfsense to send all of the syslogs to a remote machine in order to run WallWatcher on it. I have this working fine with our sonicwall, but I have not figured this part out on pfsense yet. I have several packages loaded, including the ntop which I can see this type of info with.

      I have checked 'Enable syslog'ing to remote syslog server' under the Diagnostics –-> System logs ---> Settings tab, but it is only sending the system info to the remote machine capturing the log info.

      I am trying to get full logs of the bandwidth and basic http DNS and domain names of http traffic. I am running 1.2 final.

      Basically I need to know how to enable the complete logs be sent via the syslog port 514 method. Anyone have this set up and working?

      1 Reply Last reply Reply Quote 0
      • dotdash
        dotdash last edited by

        You probably want SNMP enabled (under services).

        1 Reply Last reply Reply Quote 0
        • S
          Stoutman last edited by

          Well I just tried putting the IP of the comp to send logs to and used the default port and port 514 in both the SNMP daemon and SNMP trap and I didn't see any changes to what was being sent to syslog….

          I also do not see any useful info on the few posts in the SNMP subforum. Any other suggestions? :)

          1 Reply Last reply Reply Quote 0
          • dotdash
            dotdash last edited by

            You're trying to do what? With Wallwatcher, you can simply check the box to enable the snmp daemon under services, then in Wallwatcher: option, bandwidth should test OK on snmp. Check the box to collect data and go to file, analyze bandwidth. Leave the snmp port at default- it's not syslog. The logs are being sent via syslog and the bandwidth info is sent via snmp. The newer Wallwatcher worked for me when I played with it, but I still like monomon (http://monomon.matf.de/) better for traffic graphs.

            1 Reply Last reply Reply Quote 0
            • B
              berniem last edited by

              (This is a late reply, but I wanted to post for clarity for anyone reading this from any archives.)

              One issue may be that you might be mixing pieces of these two separate protocols.  Specifically, you said you pointed some SNMP services at port 514.  Port 514 is used by SYSLOG, not SNMP.  SNMP uses UDP 161 and UDP 162.  Your receiver should be set accordingly (or, better yet, left at the defaults for on what ports it listens).

              1 Reply Last reply Reply Quote 0
              • C
                cybrsrfr last edited by

                Syslog uses UDP 514. I've tried it on pfSense 1.2.1 and it has worked fine for me. I thought it was funner to write a basic Syslog server in PHP and make it run as a windows service rather than learning a pre-made syslog server.

                I kind of wonder if some of the SysLog servers have a hard time with the messages? Since they don't follow the spec as mentioned here.
                http://forum.pfsense.org/index.php/topic,12143.0.html

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post

                Products

                • Platform Overview
                • TNSR
                • pfSense
                • Appliances

                Services

                • Training
                • Professional Services

                Support

                • Subscription Plans
                • Contact Support
                • Product Lifecycle
                • Documentation

                News

                • Media Coverage
                • Press
                • Events

                Resources

                • Blog
                • FAQ
                • Find a Partner
                • Resource Library
                • Security Information

                Company

                • About Us
                • Careers
                • Partners
                • Contact Us
                • Legal
                Our Mission

                We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                Subscribe to our Newsletter

                Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                © 2021 Rubicon Communications, LLC | Privacy Policy