-
Notifications
You must be signed in to change notification settings - Fork 0
pfsense
The log format of pfsense is defined in the page: pfsense filter log raw format
In resume this is a standard syslog line, with a payload in a csv format with a non fix fields, this design decision suppose probably the worst case to process the log with a regular expression or filter using standard test commands as grep or awk.
Dec 5 09:53:08 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,64,48961,0,DF,1,icmp,84,192.168.3.1,192.168.3.201,request,5113,6664
Dec 5 09:53:09 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,64,49108,0,DF,1,icmp,84,192.168.3.1,192.168.3.201,request,5113,6764
Dec 5 09:53:10 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,64,49275,0,DF,1,icmp,84,192.168.3.1,192.168.3.201,request,5113,6864
Dec 5 10:29:11 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,63,17522,0,DF,6,tcp,60,192.168.4.158,192.168.3.201,35682,5963,0,S,1960648610,,64240,,mss;sackOK;TS;nop;wscale
Dec 5 10:29:11 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,63,10688,0,DF,6,tcp,60,192.168.4.158,192.168.3.201,35554,1070,0,S,3002508532,,64240,,mss;sackOK;TS;nop;wscale
Dec 5 10:29:11 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,63,4810,0,DF,6,tcp,60,192.168.4.158,192.168.3.201,54976,3351,0,S,1818934933,,64240,,mss;sackOK;TS;nop;wscale
Dec 5 10:29:11 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,63,60219,0,DF,6,tcp,60,192.168.4.158,192.168.3.201,60482,2968,0,S,2817677239,,64240,,mss;sackOK;TS;nop;wscale
Dec 5 10:28:42 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,2,56723,0,DF,17,udp,129,192.168.3.10,239.255.255.250,60200,1900,109
Dec 5 10:28:42 pfsense filterlog: 67,,,12000,vtnet0,match,block,in,4,0x0,,2,56722,0,DF,17,udp,122,192.168.3.10,239.255.255.250,60200,1900,102
Dec 5 10:28:42 pfsense filterlog: 67,,,12000,vtnet0,match,block,in,4,0x0,,2,56723,0,DF,17,udp,129,192.168.3.10,239.255.255.250,60200,1900,109
Dec 5 10:28:44 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,2,57062,0,DF,17,udp,122,192.168.3.10,239.255.255.250,41845,1900,102
Dec 5 10:28:44 pfsense filterlog: 5,,,1000103483,vtnet1,match,block,in,4,0x0,,2,57063,0,DF,17,udp,129,192.168.3.10,239.255.255.250,41845,1900,109
The pfsense use a circular log file limited in size, by default the log size of pfsense is limited to 511488bytes ( ~500K) or 3000 lines, this is a very low size and if you do not change this size, you will lose all of your logs.
Note that a normal system connected to internet produce near of 200.000 event by day, and if you not change this very low log size you are losing the half of the powerful of a firewall, the visibility.
To Change it, you need to activate the login configuration hidden menu in:
[system].[General Settup].[webConfigurator].[Associated Panels Show/Hide]
and mark: [Manage Log]
now, you ca go to: [Status].[System Logs].[Firewall].[Normal view]
Go to the end of the page and open the [Manage Firewall Log] sub menu and change this value to a more useful size, as 1000000000 ( 1Gb)
The rotation and compression of the logs are not supported by the web interface.
The pfsense firewal are located in the standard /var/log directory
[2.4.5-RELEASE][admin@pfsense.localdomain]/root: tail /var/log/filter.log
Dec 1 06:36:55 pfSense filterlog: 5,,,1000000103,vtnet1,match,block,in,4,0x0,,2,58397,0,DF,17,udp,122,192.168.3.10,239.255.255.250,45453,1900,102
Dec 1 06:36:55 pfSense filterlog: 5,,,1000000103,vtnet1,match,block,in,4,0x0,,2,58398,0,DF,17,udp,129,192.168.3.10,239.255.255.250,45453,1900,109
Dec 1 06:36:55 pfSense filterlog: 67,,,12000,vtnet0,match,block,in,4,0x0,,2,58397,0,DF,17,udp,122,192.168.3.10,239.255.255.250,45453,1900,102
Dec 1 06:36:55 pfSense filterlog: 67,,,12000,vtnet0,match,block,in,4,0x0,,2,58398,0,DF,17,udp,129,192.168.3.10,239.255.255.250,45453,1900,109
Dec 1 06:37:52 pfSense filterlog: 5,,,1000000103,vtnet1,match,block,in,4,0x0,,2,5480,0,DF,17,udp,122,192.168.3.10,239.255.255.250,55720,1900,102
Dec 1 06:37:52 pfSense filterlog: 5,,,1000000103,vtnet1,match,block,in,4,0x0,,2,5481,0,DF,17,udp,129,192.168.3.10,239.255.255.250,55720,1900,109
Dec 1 06:37:52 pfSense filterlog: 67,,,12000,vtnet0,match,block,in,4,0x0,,2,5480,0,DF,17,udp,122,192.168.3.10,239.255.255.250,55720,1900,102
Dec 1 06:37:52 pfSense filterlog: 67,,,12000,vtnet0,match,block,in,4,0x0,,2,5481,0,DF,17,udp,129,192.168.3.10,239.255.255.250,55720,1900,109
Dec 1 06:37:54 pfSense filterlog: 5,,,1000000103,vtnet1,match,block,in,4,0x0,,2,5855,0,DF,17,udp,122,192.168.3.10,239.255.255.250,57308,1900,102
Dec 1 06:37:54 pfSense filterlog: 5,,,1000000103,vtnet1,match,block,in,4,0x0,,2,5856,0,DF,17,udp,129,192.168.3.10,239.255.255.250,5CLOG���[2.4.5-RELEASE][admin@pfsense.localdomain]/root:
Note the non terminated last line and non printable characters at the end of the logs.
The scp command is nor working in the default configuration of pfsense (v2.4.5) and can not be used:
dani@morgana:~/logtest/pfsense$ scp admin@pfsense:/var/log/filter.log .
Password for admin@pfsense.localdomain:
usage: scp [-12346BCpqrv] [-c cipher] [-F ssh_config] [-i identity_file]
[-l limit] [-o ssh_option] [-P port] [-S program]
[[user@]host1:]file1 ... [[user@]host2:]file2
alternatively we can use sftp:
dani@morgana:~/logtest/pfsense$ sftp admin@pfsense:/var/log/filter.log .
Password for admin@pfsense.localdomain:
Connected to pfsense.
Fetching /var/log/filter.log to ./filter.log
/var/log/filter.log
the use of a non interactive remote access to the logs are limited by the login menu rc.initial and require a specif initial command to access to a shell ( wait: 'Enter an option:' , send: 8)
dani@morgana:~$ ssh admin@pfsense
Password for admin@pfsense.localdomain:
pfSense - Netgate Device ID: 937f2d01b94859bdbce7
*** Welcome to pfSense 2.4.5-RELEASE-p1 (amd64) on pfsense ***
WAN (wan) -> vtnet0 -> v4: 192.168.254.201/24
LAN (lan) -> vtnet1 -> v4: 192.168.3.201/24
0) Logout (SSH only) 9) pfTop
1) Assign Interfaces 10) Filter Logs
2) Set interface(s) IP address 11) Restart webConfigurator
3) Reset webConfigurator password 12) PHP shell + pfSense tools
4) Reset to factory defaults 13) Update from console
5) Reboot system 14) Disable Secure Shell (sshd)
6) Halt system 15) Restore recent configuration
7) Ping host 16) Restart PHP-FPM
8) Shell
Enter an option: 8
[2.4.5-RELEASE][admin@pfsense.localdomain]/root:
the better alternative is to create a new user to access in a real time to the host and avoid any risk of damage. but the creation of a new user is not always available.
floger support pfsense log format partially, including the as a spt the icmp type and the icmp sequence as a dpt, this is caused by the csv dynamic format used, to avoid a more complex log parser. In any case, this is a more powerful functionality, that the original and basic web log viewer.