Logs to remote syslog server not working

[reilos]

Hi there,

I'm trying to get pfSense to log to my syslog server. Other devices (a NAS and a switch) in the same subnet have no problems with logging to the syslog server, it's only the pfSense box. I've set the options:

Source Address: LAN (also tried default/any)
IP Protocol: IPv4
Enable Remote Logging: CHECKED (duh…)
Remote Syslog Servers: 192.168.1.104
Remote Syslog Contents: Everything

Any ideas?

[dvancleef]

On some platforms, by default syslogd only accepts packets from source port 514, have you investigated that?

[cmb]

Nothing more than that to it. Assuming it's a live IP, it'll send there. Filter Diag>States for :514 and you can see if it's getting passed out. Packet capture on LAN filtered on port 514 to see it going to the server. Likely it's going to the server and the server's not doing with it what you're expecting.

[reilos]

State:

LAN	udp	172.30.35.1:514 -> 172.30.35.104:514	SINGLE:NO_TRAFFIC

I'm no expert, so i had to look this one up from here:

udp.single = The state if the source host sends more than one packet but the destination host has never sent one back.

If if understand correctly, the source host (my pfSense box) is actually sending out the syslog messages via the right port to the right client host (my syslog server) on the correct port, but the client never sent any packet back.

Should there be packets sent back?

[jimp]

Not with syslog over UDP, it won't send anything back, so that's normal. The state shows the packets leaving, so perhaps they never arrive at the server. Or, more likely, the target server is filtering or rejecting them in some way.

[reilos]

@jimp:

Not with syslog over UDP, it won't send anything back, so that's normal. The state shows the packets leaving, so perhaps they never arrive at the server. Or, more likely, the target server is filtering or rejecting them in some way.

Yeah, thats what i thought. I'm looking into other solutions, like ELK (Elasticsearch, Logstash, Kibana). Seems that setting up a syslog server with analytics is not as easy as i hoped.

[kapara]

Check out papertrail.  It's hosted and free for most needs.  Even has alerting built in.  Depending on your environment.. I use one of my PC to transmit logs securely.

[reilos]

@kapara:

Check out papertrail.  It's hosted and free for most needs.  Even has alerting built in.  Depending on your environment.. I use one of my PC to transmit logs securely.

Thanks, but I'm only lokking for an on-site solution, since having an off-site syslog server doesn't help me much when my gateway has issues and i can't access the logs  ;)  And the installation itself is not that hard, it's the configuration / tweaks to get things going for specific devices (like pfSense) that is not as straightforward as i hoped.

[c1pher22]

I've just encountered this issue setting up my remote logging for the first time. Using Syslog-NG, I had to include 'create_dirs(yes)' in my syslog-ng.conf file.

Example:

destination d_remote {
file("/var/log/remote/$HOST/$YEAR/$MONTH/$DAY/syslog.log"
create_dirs(yes));
};

Cheers!