pfSense » pfSense Packages

pfBlockerNG's nightly cron ends by rewriting dnsbl.log and ip_block.log in place instead of rotating them.
pfb_log_mgmt() (pfblockerng.inc:1127-1166, called from :6675) does tail -n <log_max> log > tmp; mv -f tmp log instead of rotating.
Any external tailer such as syslog-ng to export to a SIEM re-reads the whole retained window every cron cycle.

One fix would have been to use no limit (no rotation) and use native pfsense newlogrotate, but the GUI's "No Limit" option (nolimit literal) never takes effect: pfb_filter()'s numeric-only regex (:521-525) silently converts it to the 20000 default (:661) before pfb_log_mgmt() can test for it.

Proposed fix: rotate via pfSense's native newsyslog package-logging hook instead of hand-rolled tail|mv, plus make nolimit reachable by testing it ahead of the numeric filter.