Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions packages/pfsense/_dev/build/docs/README.md
Original file line number Diff line number Diff line change
@@ -1,19 +1,20 @@
# pfSense Integration

This is an integration to parse certain logs from PFsense and OPNsense firewalls. It parses logs
received over the network via syslog (UDP/TCP/TLS). pfSense natively only supports UDP. OPNsense supports all 3 transports.
Currently the integration supports parsing the Firewall, Unbound, DHCP Daemon, OpenVPN, IPsec, HAProxy, Squid, and PHP-FPM (Authentication) logs. All other events will be dropped.
The HAProxy logs are setup to be compatible with the dashboards from the HAProxy integration. Install the HAPrxoy integration assets to utilize them.
This is an integration to parse certain logs from [pfSense and OPNsense firewalls](https://docs.netgate.com/pfsense/en/latest/). It parses logs received over the network via syslog (UDP/TCP/TLS). pfSense natively only supports UDP. OPNsense supports all 3 transports.

**pfSense Setup**
Currently the integration supports parsing the Firewall, Unbound, DHCP Daemon, OpenVPN, IPsec, HAProxy, Squid, and PHP-FPM (Authentication) logs.
All other events will be dropped.
The HAProxy logs are setup to be compatible with the dashboards from the HAProxy integration. Install the HAPrxoy integration assets to use them.

## pfSense Setup
1. Navigate to _Status -> System Logs_, then click on _Settings_
2. At the bottom check _Enable Remote Logging_
3. (Optional) Select a specific interface to use for forwarding
4. Input the agent IP address and port as set via the integration config into the field _Remote log servers_ (e.g. 192.168.100.50:5140)
5. Under _Remote Syslog Contents_ select what logs to forward to the agent
* Select _Everything_ to forward all logs to the agent or select the individual services to forward. Any log entry not in the list above will be dropped. This will cause additional data to be sent to the agent and Elasticsearch. The firewall, VPN, DHCP, DNS, and Authentication (PHP-FPM) logs are able to be individually selected. In order to collect HAProxy and Squid or other "package" logs, the _Everything_ option must be selected.

**OPNsense Setup**
## OPNsense Setup
1. Navigate to _System -> Settings -> Logging/Targets_
2. Add a new _Logging/Target_ (Click the plus icon)
- Transport = UDP or TCP or TLS
Expand All @@ -33,8 +34,8 @@ The pfSense integration supports both the BSD logging format (used by pfSense by
However the syslog format is recommended. It will provide the firewall hostname and timestamps with timezone information.
When using the BSD format, the `Timezone Offset` config must be set when deploying the agent or else the timezone will default to the timezone of the agent. See `https://<pfsense url>/status_logs_settings.php` and https://docs.netgate.com/pfsense/en/latest/monitoring/logs/settings.html for more information.

A huge thanks to [a3ilson](https://github.com/a3ilson) for the https://github.com/pfelk/pfelk repo, which is the foundation for the majority of the grok patterns and dashboards in this integration.

A huge thanks to [a3ilson](https://github.com/a3ilson) for the https://github.com/pfelk/pfelk repo which is the foundation for the majority of the grok patterns and dashboards in this integration.
## Logs

### pfSense log
Expand Down
5 changes: 5 additions & 0 deletions packages/pfsense/changelog.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.0.3"
changes:
- description: updated links in the documentation to the vendor documentation
type: enhancement
link: https://github.com/elastic/integrations/pull/3145
- version: "1.0.2"
changes:
- description: Update HAProxy log parsing to handle non HTTPS and TCP logs
Expand Down
15 changes: 8 additions & 7 deletions packages/pfsense/docs/README.md
Original file line number Diff line number Diff line change
@@ -1,19 +1,20 @@
# pfSense Integration

This is an integration to parse certain logs from PFsense and OPNsense firewalls. It parses logs
received over the network via syslog (UDP/TCP/TLS). pfSense natively only supports UDP. OPNsense supports all 3 transports.
Currently the integration supports parsing the Firewall, Unbound, DHCP Daemon, OpenVPN, IPsec, HAProxy, Squid, and PHP-FPM (Authentication) logs. All other events will be dropped.
The HAProxy logs are setup to be compatible with the dashboards from the HAProxy integration. Install the HAPrxoy integration assets to utilize them.
This is an integration to parse certain logs from [pfSense and OPNsense firewalls](https://docs.netgate.com/pfsense/en/latest/). It parses logs received over the network via syslog (UDP/TCP/TLS). pfSense natively only supports UDP. OPNsense supports all 3 transports.

**pfSense Setup**
Currently the integration supports parsing the Firewall, Unbound, DHCP Daemon, OpenVPN, IPsec, HAProxy, Squid, and PHP-FPM (Authentication) logs.
All other events will be dropped.
The HAProxy logs are setup to be compatible with the dashboards from the HAProxy integration. Install the HAPrxoy integration assets to use them.

## pfSense Setup
1. Navigate to _Status -> System Logs_, then click on _Settings_
2. At the bottom check _Enable Remote Logging_
3. (Optional) Select a specific interface to use for forwarding
4. Input the agent IP address and port as set via the integration config into the field _Remote log servers_ (e.g. 192.168.100.50:5140)
5. Under _Remote Syslog Contents_ select what logs to forward to the agent
* Select _Everything_ to forward all logs to the agent or select the individual services to forward. Any log entry not in the list above will be dropped. This will cause additional data to be sent to the agent and Elasticsearch. The firewall, VPN, DHCP, DNS, and Authentication (PHP-FPM) logs are able to be individually selected. In order to collect HAProxy and Squid or other "package" logs, the _Everything_ option must be selected.

**OPNsense Setup**
## OPNsense Setup
1. Navigate to _System -> Settings -> Logging/Targets_
2. Add a new _Logging/Target_ (Click the plus icon)
- Transport = UDP or TCP or TLS
Expand All @@ -33,8 +34,8 @@ The pfSense integration supports both the BSD logging format (used by pfSense by
However the syslog format is recommended. It will provide the firewall hostname and timestamps with timezone information.
When using the BSD format, the `Timezone Offset` config must be set when deploying the agent or else the timezone will default to the timezone of the agent. See `https://<pfsense url>/status_logs_settings.php` and https://docs.netgate.com/pfsense/en/latest/monitoring/logs/settings.html for more information.

A huge thanks to [a3ilson](https://github.com/a3ilson) for the https://github.com/pfelk/pfelk repo, which is the foundation for the majority of the grok patterns and dashboards in this integration.

A huge thanks to [a3ilson](https://github.com/a3ilson) for the https://github.com/pfelk/pfelk repo which is the foundation for the majority of the grok patterns and dashboards in this integration.
## Logs

### pfSense log
Expand Down
2 changes: 1 addition & 1 deletion packages/pfsense/manifest.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: pfsense
title: pfSense Logs
version: "1.0.2"
version: "1.0.3"
release: ga
description: Collect and parse logs from pfSense and OPNsense devices with Elastic Agent.
type: integration
Expand Down