diff --git a/packages/pfsense/_dev/build/docs/README.md b/packages/pfsense/_dev/build/docs/README.md index 12e56b784b2..022712a40b9 100644 --- a/packages/pfsense/_dev/build/docs/README.md +++ b/packages/pfsense/_dev/build/docs/README.md @@ -1,11 +1,12 @@ # pfSense Integration -This is an integration to parse certain logs from PFsense and OPNsense firewalls. It parses logs -received over the network via syslog (UDP/TCP/TLS). pfSense natively only supports UDP. OPNsense supports all 3 transports. -Currently the integration supports parsing the Firewall, Unbound, DHCP Daemon, OpenVPN, IPsec, HAProxy, Squid, and PHP-FPM (Authentication) logs. All other events will be dropped. -The HAProxy logs are setup to be compatible with the dashboards from the HAProxy integration. Install the HAPrxoy integration assets to utilize them. +This is an integration to parse certain logs from [pfSense and OPNsense firewalls](https://docs.netgate.com/pfsense/en/latest/). It parses logs received over the network via syslog (UDP/TCP/TLS). pfSense natively only supports UDP. OPNsense supports all 3 transports. -**pfSense Setup** +Currently the integration supports parsing the Firewall, Unbound, DHCP Daemon, OpenVPN, IPsec, HAProxy, Squid, and PHP-FPM (Authentication) logs. +All other events will be dropped. +The HAProxy logs are setup to be compatible with the dashboards from the HAProxy integration. Install the HAPrxoy integration assets to use them. + +## pfSense Setup 1. Navigate to _Status -> System Logs_, then click on _Settings_ 2. At the bottom check _Enable Remote Logging_ 3. (Optional) Select a specific interface to use for forwarding @@ -13,7 +14,7 @@ The HAProxy logs are setup to be compatible with the dashboards from the HAProxy 5. Under _Remote Syslog Contents_ select what logs to forward to the agent * Select _Everything_ to forward all logs to the agent or select the individual services to forward. Any log entry not in the list above will be dropped. This will cause additional data to be sent to the agent and Elasticsearch. The firewall, VPN, DHCP, DNS, and Authentication (PHP-FPM) logs are able to be individually selected. In order to collect HAProxy and Squid or other "package" logs, the _Everything_ option must be selected. -**OPNsense Setup** +## OPNsense Setup 1. Navigate to _System -> Settings -> Logging/Targets_ 2. Add a new _Logging/Target_ (Click the plus icon) - Transport = UDP or TCP or TLS @@ -33,8 +34,8 @@ The pfSense integration supports both the BSD logging format (used by pfSense by However the syslog format is recommended. It will provide the firewall hostname and timestamps with timezone information. When using the BSD format, the `Timezone Offset` config must be set when deploying the agent or else the timezone will default to the timezone of the agent. See `https:///status_logs_settings.php` and https://docs.netgate.com/pfsense/en/latest/monitoring/logs/settings.html for more information. +A huge thanks to [a3ilson](https://github.com/a3ilson) for the https://github.com/pfelk/pfelk repo, which is the foundation for the majority of the grok patterns and dashboards in this integration. -A huge thanks to [a3ilson](https://github.com/a3ilson) for the https://github.com/pfelk/pfelk repo which is the foundation for the majority of the grok patterns and dashboards in this integration. ## Logs ### pfSense log diff --git a/packages/pfsense/changelog.yml b/packages/pfsense/changelog.yml index c8157b28cd8..fdaa71884f3 100644 --- a/packages/pfsense/changelog.yml +++ b/packages/pfsense/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.0.3" + changes: + - description: updated links in the documentation to the vendor documentation + type: enhancement + link: https://github.com/elastic/integrations/pull/3145 - version: "1.0.2" changes: - description: Update HAProxy log parsing to handle non HTTPS and TCP logs diff --git a/packages/pfsense/docs/README.md b/packages/pfsense/docs/README.md index bcdfbd09f3c..07f30b6ccd8 100644 --- a/packages/pfsense/docs/README.md +++ b/packages/pfsense/docs/README.md @@ -1,11 +1,12 @@ # pfSense Integration -This is an integration to parse certain logs from PFsense and OPNsense firewalls. It parses logs -received over the network via syslog (UDP/TCP/TLS). pfSense natively only supports UDP. OPNsense supports all 3 transports. -Currently the integration supports parsing the Firewall, Unbound, DHCP Daemon, OpenVPN, IPsec, HAProxy, Squid, and PHP-FPM (Authentication) logs. All other events will be dropped. -The HAProxy logs are setup to be compatible with the dashboards from the HAProxy integration. Install the HAPrxoy integration assets to utilize them. +This is an integration to parse certain logs from [pfSense and OPNsense firewalls](https://docs.netgate.com/pfsense/en/latest/). It parses logs received over the network via syslog (UDP/TCP/TLS). pfSense natively only supports UDP. OPNsense supports all 3 transports. -**pfSense Setup** +Currently the integration supports parsing the Firewall, Unbound, DHCP Daemon, OpenVPN, IPsec, HAProxy, Squid, and PHP-FPM (Authentication) logs. +All other events will be dropped. +The HAProxy logs are setup to be compatible with the dashboards from the HAProxy integration. Install the HAPrxoy integration assets to use them. + +## pfSense Setup 1. Navigate to _Status -> System Logs_, then click on _Settings_ 2. At the bottom check _Enable Remote Logging_ 3. (Optional) Select a specific interface to use for forwarding @@ -13,7 +14,7 @@ The HAProxy logs are setup to be compatible with the dashboards from the HAProxy 5. Under _Remote Syslog Contents_ select what logs to forward to the agent * Select _Everything_ to forward all logs to the agent or select the individual services to forward. Any log entry not in the list above will be dropped. This will cause additional data to be sent to the agent and Elasticsearch. The firewall, VPN, DHCP, DNS, and Authentication (PHP-FPM) logs are able to be individually selected. In order to collect HAProxy and Squid or other "package" logs, the _Everything_ option must be selected. -**OPNsense Setup** +## OPNsense Setup 1. Navigate to _System -> Settings -> Logging/Targets_ 2. Add a new _Logging/Target_ (Click the plus icon) - Transport = UDP or TCP or TLS @@ -33,8 +34,8 @@ The pfSense integration supports both the BSD logging format (used by pfSense by However the syslog format is recommended. It will provide the firewall hostname and timestamps with timezone information. When using the BSD format, the `Timezone Offset` config must be set when deploying the agent or else the timezone will default to the timezone of the agent. See `https:///status_logs_settings.php` and https://docs.netgate.com/pfsense/en/latest/monitoring/logs/settings.html for more information. +A huge thanks to [a3ilson](https://github.com/a3ilson) for the https://github.com/pfelk/pfelk repo, which is the foundation for the majority of the grok patterns and dashboards in this integration. -A huge thanks to [a3ilson](https://github.com/a3ilson) for the https://github.com/pfelk/pfelk repo which is the foundation for the majority of the grok patterns and dashboards in this integration. ## Logs ### pfSense log diff --git a/packages/pfsense/manifest.yml b/packages/pfsense/manifest.yml index f738f802565..6889f59e3d8 100644 --- a/packages/pfsense/manifest.yml +++ b/packages/pfsense/manifest.yml @@ -1,6 +1,6 @@ name: pfsense title: pfSense Logs -version: "1.0.2" +version: "1.0.3" release: ga description: Collect and parse logs from pfSense and OPNsense devices with Elastic Agent. type: integration