search

lephisto / pfsense-analytics

Pfsense Analytics w/ Graylog, Elasticsearch, InfluxDB and Grafana fully dockerized for Firewall and DPI..
GNU General Public License v3.0
156 stars 56 forks source link

Graylog Pfsesne 2.5.1extractor not working properly #59

Open cmithelpdesk opened 3 years ago

cmithelpdesk commented 3 years ago

Look like the Graylog extractor not working properly as the stream search doesn't have source and dest IP details. Refer to attached. My PFsense version 2.5.1 Any workaround available

graylog

bioscopic commented 3 years ago

Try updating to the latest pfsense version if you can. Then make sure your time zones all match.

fatal-bundy commented 2 years ago

Hey @cmithelpdesk

This will be because your logs are set to syslog (rfc 5424) in pfsense

Change this to BSD (rfc 3164).

you will also need to revert any changes you made to the stream rules in graylog.

Regards Corey

N00BIER commented 1 year ago

Hey @cmithelpdesk

This will be because your logs are set to syslog (rfc 5424) in pfsense

Change this to BSD (rfc 3164).

you will also need to revert any changes you made to the stream rules in graylog.

Regards Corey

Does not seem to be correct since input takes Syslog UDP.

@cmithelpdesk, just make sure your PFsenseExtractor is set to Always try to extract.