# Pfsense Syslog issue

**URL:** <https://community.graylog.org/t/pfsense-syslog-issue/15624>\
**Category:** Graylog Central (peer support)\
**Created:** [May 27, 2020, 2:03pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624 "2020-05-27T14:03:08Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 27, 2020, 2:03pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/1 "2020-05-27T14:03:08Z")

</div>

Hi Guys,

I am having issue with syslog forwarding to Graylog.

I am using pfsense, and setup graylog on the centos, I setup what was required, but graylog cannot see syslogs from pfsense.

What i missed? thanks ![graylogs](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4976c1ecb4219273e58fa6b5da9207cf90468358.png)

---

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 27, 2020, 2:03pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/2 "2020-05-27T14:03:34Z")

</div>

![pfsense](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5a4bf3c909634aa6efdb1359216939279d729c5e.png)

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 27, 2020, 3:09pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/3 "2020-05-27T15:09:24Z")

</div>

he @anxion

did you checked if any firewall is in between?

---

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 27, 2020, 3:19pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/4 "2020-05-27T15:19:26Z")

</div>

Hi Jan,

No extra firewall only pfesense, they are on the same LAN

When I check Packets capture, I see that they communicate to each other ? Only ICMP is blocked.

16:16:20.539702 IP 192.168.0.1.514 \> 192.168.0.10.1514: UDP, length 321  
16:16:20.539739 IP 192.168.0.1.514 \> 192.168.0.10.1514: UDP, length 321  
16:16:20.539967 IP 192.168.0.1.514 \> 192.168.0.10.1514: UDP, length 320  
16:16:20.540010 IP 192.168.0.1.514 \> 192.168.0.10.1514: UDP, length 320  
16:16:20.540058 IP 192.168.0.10 \> 192.168.0.1: ICMP host 192.168.0.10 unreachable - admin prohibited filter, length 357  
16:16:20.540099 IP 192.168.0.10 \> 192.168.0.1: ICMP host 192.168.0.10 unreachable - admin prohibited filter, length 357  
16:16:20.540200 IP 192.168.0.10 \> 192.168.0.1: ICMP host 192.168.0.10 unreachable - admin prohibited filter, length 356  
16:16:20.540231 IP 192.168.0.10 \> 192.168.0.1: ICMP host 192.168.0.10 unreachable - admin prohibited filter, length 356  
16:16:20.540962 IP 192.168.0.1.514 \> 192.168.0.10.1514: UDP, length 292  
16:16:20.541008 IP 192.168.0.1.514 \> 192.168.0.10.1514: UDP, length 292  
16:16:25.499551 ARP, Request who-has 192.168.0.1 tell 192.168.0.10, length 46  
16:16:25.499587 ARP, Reply 192.168.0.1 is-at xxxxxxxx, length 28

---

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 27, 2020, 3:38pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/5 "2020-05-27T15:38:42Z")

</div>

Do you think that I should try to disable firewall in Centos?

---

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 27, 2020, 3:43pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/6 "2020-05-27T15:43:58Z")

</div>

Hi Jan,

When i disabled Firewall on Centos all is working now. So it means that I need to put a rule for 1514? or 514?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [May 28, 2020, 6:34am UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/7 "2020-05-28T06:34:50Z")

</div>

you ingest to 1514 … that is the port that needs to be open…

---

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 28, 2020, 8:17am UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/8 "2020-05-28T08:17:33Z")

</div>

thanks

Graylog is nightmate to work with pfsense 😕

I created pipeline (copied from github) Please see below.

But nothing is happening, does not work at all, any idea? thanks

rule “Extract Snort alert fields”  
when  
has\_field(“message”)  
then  
let m = regex("\s?\[(\d+):(\d+):(\d+)\] (.+?) \[Classification: (.+?)\] \[Priority: (\d+)]: \\<(.+?)\\> \{(.+?)\} (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))? -\> (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))?\R?", to\_string($message.message));

set\_field(“snort\_alert”, true);  
set\_field(“generator\_id”, m[“0”]);  
set\_field(“signature\_id”, m[“1”]);  
set\_field(“signature\_revision\_id”, m[“2”]);  
set\_field(“description”, m[“3”]);  
set\_field(“classification”, m[“4”]);  
set\_field(“priority”, to\_long(m[“5”]));  
set\_field(“interface”, m[“6”]);  
set\_field(“protocol”, m[“7”]);  
set\_field(“src\_addr”, m[“8”]);  
set\_field(“src\_port”, to\_long(m[“10”]));  
set\_field(“dst\_addr”, m[“11”]);  
set\_field(“dst\_port”, to\_long(m[“13”]));  
end

---

<div class="post-metadata">

**Author:** ![facyber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/facyber/32/5209_2.png) [@facyber](https://community.graylog.org/u/facyber)\
**Post date:** [May 28, 2020, 2:07pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/9 "2020-05-28T14:07:35Z")

</div>

Hey I updated [Hobadee’s](https://github.com/Hobadee/Graylog_Extractors_pfSense) version of pfsense Extractor for Graylog 3.0 and it works so far. You can check it on my [GitHub account](https://github.com/facyber/pfSense-Graylog-Extractor/tree/master). So far everything works good for me and I plan to expand it for IPSec logs. 🙂

---

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 28, 2020, 2:35pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/10 "2020-05-28T14:35:18Z")

</div>

Hi

You just upload it ?

---

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 28, 2020, 2:52pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/11 "2020-05-28T14:52:04Z")

</div>

thanks,

I have added your extractor, however still dont see it in search. Please see image below.

 ![graylogs](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/18d6ac265da641527c81b4e09af6b1a34dd64260.png)

---

<div class="post-metadata">

**Author:** ![facyber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/facyber/32/5209_2.png) [@facyber](https://community.graylog.org/u/facyber)\
**Post date:** [May 28, 2020, 4:22pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/12 "2020-05-28T16:22:27Z")

</div>

What Input settings are you using? For pfSense logs I am using Syslog UDP. Then I created specific Stream for pfSense, and also specific index, but that shouldn’t cause the issue I believe.

Also check Elasticsearch logs, maybe you will find there something that would point to some error.

---

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 28, 2020, 4:46pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/13 "2020-05-28T16:46:31Z")

</div>

hI  
I Use UDP syslog. The difference that I have noticed I have more of these, please see below.

 ![graylogs](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/84e35b64a210f6535f73452ad3e3d95f8101040b.png)

---

<div class="post-metadata">

**Author:** ![facyber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/facyber/32/5209_2.png) [@facyber](https://community.graylog.org/u/facyber)\
**Post date:** [May 28, 2020, 5:05pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/14 "2020-05-28T17:05:06Z")

</div>

Yes now you can filter search by each of the fields from the pfSense extractors.

Those logs in the backgrounds looks like pfsense logs tho, only in raw format of course.

You are keep trying to filter based on source input, I presume you tried simple Search all logs regard the input, to see if there are pfsense logs?

---

<div class="post-metadata">

**Author:** ![anxion](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@anxion](https://community.graylog.org/u/anxion)\
**Post date:** [May 28, 2020, 10:16pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/15 "2020-05-28T22:16:43Z")

</div>

Hi Facyber,

I am new with greylog. 😕

I was following this tutorial.

[![](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/daf93e1eb8a3032dbec847b8c68bfb90ab7dd64f.jpeg "#3 How to send pfSense Logs into Graylog | Free Log Management And Visualization Course") ](https://www.youtube.com/watch?v=9nnHbYUKNio)

---

<div class="post-metadata">

**Author:** ![facyber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/facyber/32/5209_2.png) [@facyber](https://community.graylog.org/u/facyber)\
**Post date:** [June 2, 2020, 1:19pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/16 "2020-06-02T13:19:48Z")

</div>

I followed only official documentation, we are not using grafana or something else, pure Graylog only. I suggest you to check Elasticsearch log files. 😕

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 16, 2020, 1:19pm UTC](https://community.graylog.org/t/pfsense-syslog-issue/15624/17 "2020-06-16T13:19:58Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.