pfSense

On pfSense Plus 26.03.1-RELEASE (FreeBSD 15, privilege-separated syslogd), enabling Remote Logging to any destination makes syslogd die within a second or two of every start, before it writes a single local line. It parses the full ruleset, then the privilege-separation config transfer fails and the daemon exits. If Service Watchdog is watching syslogd it restarts it every 60 seconds and it crash-loops indefinitely: all /var/log files freeze and nothing is forwarded. Local-only logging is unaffected.

This appears distinct from the already-fixed remote-refusal regression #16362. Here the remote collector is reachable and actively listening (verified UDP and TCP), and the failure is an internal socket / nvlist error at startup, not a send-time "sendto: Connection refused".

Environment

• pfSense Plus 26.03.1-RELEASE, amd64. /usr/sbin/syslogd build dated 2026-05-20.
• Remote target: a reachable syslog collector on the LAN, listening on both UDP and TCP port 5514 (0% ICMP loss to it).
• Nothing is bound to UDP/TCP 514 on the firewall (verified with sockstat).
• Reproduces with Source Address = Default and with = LAN, and with Log Message Format = Syslog (RFC 5424) and with = BSD (RFC 3164).

Steps to reproduce

1. Status > System Logs > Settings: enable Remote Logging to a reachable collector, Save.
2. syslogd is absent or flapping (ps auxww | grep syslogd); /var/log/system.log stops updating; Service Watchdog restarts it every 60s to no effect.

Actual result

Running the equivalent launch in the foreground (single instance, Service Watchdog disabled), immediately after the remote-forward rule is parsed:

cfline("*.*   @[collector]:5514", f, "*", "*", "*")
syslogd: connect: Address already in use
Failed to xfer configuration nvlist: Socket is not connected
logmsg: pri 53, flags 0, from [firewall], msg Failed to xfer configuration nvlist: Socket is not connected
Logging to CONSOLE /dev/console

Expected result

syslogd starts, logs locally, and forwards to the reachable collector.

Diagnosis and things ruled out

• Config parses fully: no malformed rule, no clog open error.
• Remote name resolves; collector reachable and listening on both UDP and TCP.
• Nothing else is bound to port 514; a single clean instance (no second syslogd, watchdog disabled) still crashes, so this is not a two-instance collision.
• Identical with and without -O rfc5424, and with and without the -b [lan-ip] source bind.
• Removing the single remote-forward line from the generated ruleset makes syslogd start cleanly and log to /var/log/system.log (verified in the foreground). Re-adding any remote destination reproduces the crash. So the trigger is the presence of a remote-forward destination, and the fault is in the privilege-separation handling of forwarding (the nvlist "Socket is not connected"), not local logging.

Not a duplicate of

• #16362 / #16458: remote refuses / unreachable, already fixed in Plus 25.11 and present in this build. This case has a reachable, listening collector; it crashes on start with a different error.
• #15874: restart triggered by a "Deny Config Write" user. Not applicable here.
• #11577: rejected feature about interface binding; the source bind is removed here and it still crashes.
• #196 / #929 / #4981 / #1111 / #4393 / #7256 / #12747: pre-FreeBSD-15 or unrelated triggers.

Impact and workaround

No configuration workaround was found (log format and source address both ruled out). The only mitigation is disabling remote logging, which loses forwarding.

Tested: 26.03.1-RELEASE.