pfSense

I was previously running the Aug 28 build, and it existed there. Updated to latest build today and still there.

I'm using the version 2.0-Beta4 Wed. sep 29 12:15:10 EDT 2010

The logging on remote server work fine.

May be your setting in system log configuration is wrong !!

I also confirm this is working in recent snapshots.

Can you give the syslog part of your /cf/conf/config.xml file ?

Mine looks like this.

        <syslog>
                <nentries>1000</nentries>
                <remoteserver>10.0.0.20</remoteserver>
                <logall/>
                <enable/>
                <remoteserver2/>
                <remoteserver3/>
        </syslog>

But...

# grep 10.0.0.20 /var/etc/syslog.conf
#

<syslog>
<reverse/>
<nentries>100</nentries>
<logall/>
<remoteserver>10.195.2.147</remoteserver>
<remoteserver2/>
<remoteserver3/>
<enable/>
</syslog>

1. grep 10.195.2.147 /var/etc/syslog.conf #

1. grep 10.195.2.147 /etc/syslog.conf #

Mine is :

        <syslog>
                <nentries>50</nentries>
                <remoteserver>192.168.2.2</remoteserver>
                <remoteserver2/>
                <remoteserver3/>
                <filter/>
                <dhcp/>
                <portalauth/>
                <vpn/>
                <logall/>
                <system/>
                <enable/>
        </syslog>

So more (empty) stuff in it...

Can you try to save again in the screen ? Just to be sure this is not due a (bad) config upgrade ?

Have unchecked and rechecked enable remote syslog multiple times, have removed the syslog server and put in a different one, have tried on 4 different pfsense hosts running on vmware. All have the same issue.

they are all clustered though, Chris are your pfsense's clustered as well?

Can you also send me your syslog.conf ?

Thanks,
Pierre

# vi /var/etc/syslog.conf
!ntpdate,!ntpd
*.*                                      %/var/log/ntpd.log
!ppp
*.*                                      %/var/log/ppp.log
!pptp
*.*                                      %/var/log/pptp.log
!pppoe
*.*                                      %/var/log/pppoe.log
!l2tp
*.*                                      %/var/log/l2tp.log
!racoon
*.*                                      %/var/log/ipsec.log
!openvpn
*.*                                      %/var/log/openvpn.log
!apinger
*.*                                      %/var/log/apinger.log
!relayd
*.*                                             %/var/log/relayd.log
!-ntpd,racoon,openvpn
local0.*                                                                                 %/var/log/filte
r.log
local3.*                                                                                 %/var/log/vpn.l
og
local4.*                                                                                 %/var/log/porta
lauth.log
local7.*                                                                                 %/var/log/dhcpd
.log
*.notice;kern.debug;lpr.info;mail.crit;                  %/var/log/system.log
news.err;local0.none;local3.none;local4.none;    %/var/log/system.log
local7.none                                                                              %/var/log/syste
m.log
security.*                                                                               %/var/log/syste
m.log
auth.info;authpriv.info;daemon.info                              %/var/log/system.log
auth.info;authpriv.info                                                  |exec /usr/local/sbin/sshlockou
t_pf
*.emerg                                                                                  *

problem seems to be when only ticking the checkbox for "Everything"

if i check all the checkboxes I get:

# cat /etc/syslog.conf
!ntpdate,!ntpd
*.*                                      %/var/log/ntpd.log
!ppp
*.*                                      %/var/log/ppp.log
!pptp
*.*                                      %/var/log/pptp.log
!pppoe
*.*                                      %/var/log/pppoe.log
!l2tp
*.*                                      %/var/log/l2tp.log
!racoon
*.*                                      %/var/log/ipsec.log
*.*                                      @10.195.2.147
!openvpn
*.*                                      %/var/log/openvpn.log
*.*                                      @10.195.2.147
!apinger
*.*                                      %/var/log/apinger.log
!relayd
*.*                                             %/var/log/relayd.log
!-ntpd,racoon,openvpn
local0.*                                                                                 %/var/log/filter.log
local3.*                                                                                 %/var/log/vpn.log
local4.*                                                                                 %/var/log/portalauth.log
local7.*                                                                                 %/var/log/dhcpd.log
*.notice;kern.debug;lpr.info;mail.crit;                  %/var/log/system.log
news.err;local0.none;local3.none;local4.none;    %/var/log/system.log
local7.none                                                                              %/var/log/system.log
security.*                                                                               %/var/log/system.log
auth.info;authpriv.info;daemon.info                              %/var/log/system.log
auth.info;authpriv.info                                                  |exec /usr/local/sbin/sshlockout_pf
*.emerg                                                                                  *
local0.*                         @10.195.2.147
local3.*                         @10.195.2.147
local4.*                         @10.195.2.147
local7.*                         @10.195.2.147
*.notice;kern.debug;lpr.info;mail.crit;                  @10.195.2.147
news.err;local0.none;local3.none;local7.none     @10.195.2.147
security.*                                                                               @10.195.2.147
auth.info;authpriv.info;daemon.info                              @10.195.2.147
*.emerg                                                                                  @10.195.2.147
*.*                                                             @10.195.2.147

Looks like it is fixed. Thanks :)