Skip to main content

​
Set up

Follow the shared Log Forwarders guide to add pfSense / OPNsense and open Forwarder Details (or ask Chat for the listener ip:port).

​
pfSense

  1. Open Status > System Logs and select the Settings tab
  2. Under General Logging Options, set Log Message Format to syslog (RFC 5424, with RFC 3339 microsecond-precision timestamps). Its timestamps carry the UTC offset and it includes the firewall’s hostname. BSD (RFC 3164, default) is also supported, but it carries no hostname and its timestamps have no time zone, so they are read as UTC. This setting also changes the format of the firewall’s local logs
  3. Under Remote Logging Options, check Enable Remote Logging
  4. Enter the listener as ip:port in Server 1 under Remote log servers. pfSense sends only over UDP, so use a UDP listener. UDP syslog is unencrypted and unauthenticated, so send it only over a trusted network or VPN tunnel. If it must leave through a VPN, set Source Address to that interface
  5. Under Remote Syslog Contents, select Everything. If you’d rather limit it, select at least Firewall Events, DHCP Events, and DNS Events
  6. Click Save. Events will begin showing up shortly
DHCP lease details are parsed from the Kea DHCP server, which is selected under System > Advanced > Networking > Server Backend. Lines from the deprecated ISC DHCP backend are kept under Other.

​
OPNsense

  1. Open System > Settings > Logging and select the Remote tab
  2. Click + to add a destination and check Enabled
  3. Set Transport to match Forwarder Details (UDP(4), TCP(4), or TLS(4), or the (6) variant for an IPv6 listener), and enter the listener’s Hostname and Port
  4. Leave Applications empty to send everything, or select at least filter (filterlog) and your DHCP server: kea (kea-dhcp4), dhcpd (dhcpd), or dnsmasq (dnsmasq)
  5. Check RFC5424, click Save, then click Apply
If Forwarder Details shows TLS: Enabled, OPNsense needs two things before it can connect. First, import the CA that issued Wirespeed’s certificate under System > Trust > Authorities. Second, select a client certificate in the destination’s Certificate field. OPNsense won’t save a TLS destination without one; any certificate with a private key from System > Trust > Certificates works. See Syslog over TLS.

​
Parsed events

Each line is tagged with its program family (filterlog, kea_dhcp, filterdns, cron, or other). pfSense’s default BSD (RFC 3164) format carries no hostname, so the host field is empty unless you switch Log Message Format to syslog (RFC 5424).
  • Firewall (filterlog): rule number, sub-rule, anchor, tracker, interface, reason, action, and direction, plus the IPv4 or IPv6 header (TTL or hop limit, flags, protocol, length, source and destination IPs). TCP and UDP add ports and data length; TCP adds flags, sequence, acknowledgment, window, and options. ICMP adds the type and its per-type fields, and CARP adds its advertisement fields. OPNsense is detected from its 32-character rule label and recorded as the variant.
  • DHCP (kea_dhcp): Kea log level, logger, and message ID. Lease messages such as DHCP4_LEASE_ALLOC add the client MAC, client ID, transaction ID, leased IP, and lease duration.
  • Filter DNS (filterdns): the alias hostname being resolved, recorded as a domain. On pfSense this requires DNS Events or Everything.
  • Cron (cron): the user and command.
  • Other: lines from other programs are kept with their program name and message. webConfigurator (nginx) access lines also include the client IP, request, status, and user agent.
Sign-ins to the web interface and SSH are not yet normalized.