Bug #10607
Remote syslog for "General Authentication Events" using wrong selectors
100%
Description
When "General Authentication Events" is selected, the remote syslog line uses "*.*" and not "auth.*;authpriv.*". This is causing unintended duplication of some log entries on the remote server, or more log entries than intended, depending on the options selected by the user.
This only affects 2.5.0 as that option is new there.
Likely also the cause of #10588
Associated revisions
History
#1
Updated by Jim Pingle 11 months ago
- Status changed from Confirmed to Feedback
- % Done changed from 0 to 100
Applied in changeset e2119c732291143e0e0eff4f2aa1be70554b6315.
#2
Updated by Russell Morris 11 months ago
Thanks! Sorry, but a dumb question ... how to know when this will show up in an "official" build (to install, and confirm it's all working as expected)?
Thanks again.
#3
Updated by Jim Pingle 11 months ago
It will be in the next 2.5.0 snapshot that includes it, so as soon as the build happens, likely later today.
#4
Updated by Russell Morris 11 months ago
Sounds great, thanks! And appreciate all the help!
#5
Updated by Russell Morris 10 months ago
Hi,
2.5.0 got updated today (or late yesterday) ... :-). So I installed, and it works - thanks! Just one minor thing (below) ... not sure if it matters or not, but just so you know about it (and also not sure how fussy / particular you are about it ... LOL).
In /var/etc/syslog.d/pfSense.conf, if I look at most "sections", they appear like this (example one here),
!ntp,ntpd,ntpdate *.* /var/log/ntpd.log *.* @remote-server
But, the updated "section" looks like this,
!* auth.*;authpriv.* /var/log/auth.log auth.*;authpriv.* @remote-server
Would you rather it be like this, so it matches all the others?
!auth,authpriv *.* /var/log/auth.log *.* @remote-server
It doesn't matter to me, just wanted to feed this back to you - so you can make the call.
Thanks again!
#6
Updated by Jim Pingle 10 months ago
auth and authpriv are facilities, not process names, so that would not work. It's correct as it is. That section isn't like the others. The others want all log messages (facilities and levels) from specific processes. These want specific types of messages from all processes.
#7
Updated by Russell Morris 10 months ago
Makes complete sense, thanks for clarifying. And appreciate all the help!
#8
Updated by Jim Pingle 10 months ago
- Status changed from Feedback to Resolved
Correct selectors for remote auth logs. Fixes #10607