Push pfsense logs to remote machine using rsyslog

Question

I am working on to push pfsense all logs to remote machine using rsyslog.

 Machine1 ==>  Pfsense(freebsd)(192.168.1.1) pfsense basically install syslog

I have follow this document I gave used freebsd.

I did:

add below content to this /etc/rc.conf

      syslogd_flags=" -a 192.168.1.1 "

192.168.1.1 is pfsense IP

Then, Open /etc/syslog.conf

. @192.168.1.137:514

Then, Restart the Syslog Service.

  /etc/rc.d/syslogd restart

Then enable the Remote Logging in status --> system Logs --> setting

    --> Check Enable syslog'ing to remote syslog server

    --> Type the IP of the logging server in the box next to Remote syslog server

    --> Check the boxes for the log entries to forward

    -->  Click Save

Then, go to my Server machine.

   Machine2 ==>  Server(Fedora25)(192.168.1.137)

I have installed rsyslog in my server machine edit /etc/rsyslog.conf

  # rsyslog configuration file

  # For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
  # or latest version online at http://www.rsyslog.com/doc/rsyslog_conf.html
  # If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

  #### MODULES ####

  module(load="imuxsock"    # provides support for local system logging (e.g. via logger command)
         SysSock.Use="off") # Turn off message reception via local log socket;
                            # local messages are retrieved through imjournal now.
  module(load="imjournal"             # provides access to the systemd journal
         StateFile="imjournal.state") # File to store the position in the journal
  #module(load="imklog") # reads kernel messages (the same are read from journald)
  #module(load"immark") # provides --MARK-- message capability

  # Provides UDP syslog reception
  # for parameters see http://www.rsyslog.com/doc/imudp.html
  #module(load="imudp") # needs to be done just once
  #input(type="imudp" port="514")

  # Provides TCP syslog reception
  # for parameters see http://www.rsyslog.com/doc/imtcp.html
  module(load="imtcp") # needs to be done just once
  input(type="imtcp" port="514")

  $ModLoad  imtcp

  $InputTCPServerRun 514

  # local/regular rules, like

  #### GLOBAL DIRECTIVES ####

  # Where to place auxiliary files
  global(workDirectory="/var/lib/rsyslog")

  # Use default timestamp format
  module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat")
  # Include all config files in /etc/rsyslog.d/
  $IncludeConfig /etc/rsyslog.d/*.conf

  #### RULES ####

  # Log all kernel messages to the console.
  # Logging much else clutters up the screen.
  #kern.*                                                 /dev/console

  # Log anything (except mail) of level info or higher.
  # Don't log private authentication messages!
  *.info;mail.none;authpriv.none;cron.none                /var/pfsense/messages

  # The authpriv file has restricted access.
  authpriv.*                                              /var/pfsense/secure

  # Log all the mail messages in one place.
  mail.*                                                  -/var/pfsene/maillog

  # Log cron stuff
  cron.*                                                  /var/pfsense/cron

  # Everybody gets emergency messages
  # Everybody gets emergency messages
  *.emerg                                                 :omusrmsg:*

  # Save news errors of level crit and higher in a special file.
  uucp,news.crit                                          /var/pfsense/spooler

  # Save boot messages also to boot.log
  local7.*                                                /var/pfsense/boot.log

After that restart the rsyslog service, its started, But I never get any logs from pfsense.

Suggest Me,

What i miss this Configuration?

Is there any issue, pfsense used syslog and my server machine used rsyslog?

Rajkumar .E · Accepted Answer · 2017-07-19T05:57:05.293

Finally Solved My issue, Now logged Pfsense log message in remote machine.

I have added tmpl.conf in with /etc/rsyslog/tmpl.conf in my server machine.

  $template TmplAuth, "/var/log/Pfsense/%HOSTNAME%/%PROGRAMNAME%.log"
  $template TmplMsg, "/var/log/Pfsense/%HOSTNAME%/%PROGRAMNAME%.log"

  authpriv.* ?TmplAuth
  *.info;mail.none;authpriv.none;cron.none ?TmplMsg

Then,

Stop firewall and restart My rsyslog and pfsense syslog service. Now Logged Pfsense Log information to My server machine.

Reference: https://www.youtube.com/watch?v=8RiHV3HKiCU&index=4&list=PLC9VYvBgfn48oJAUUw3ipalfK63V_k2I3

Push pfsense logs to remote machine using rsyslog

1 Answers1