|
We have a pfSense firewall in our datacentre. By default, pfSense is only storing 500K of firewall filter logs, which is only a few hours for us. How can I increase this? pfSense uses clog rather than the usual BSD newsyslog. I only want the log for debugging firewall rules, not compliance or anything, and the firewall has 100GB of spare disk space, so I'd rather have the logs on the firewall itself than set up a syslog server.
| ||||
|
feedback
|
|
there are several ways to do this. why don't you read the excellent and useful mailing archives for pfsense, or check their forums? anyway, there are two ways to increase logs. firstly to increase the size of the clog files by reinitialising them. another way is to install a regular syslogger which captures logs in the regular way. you can then use that syslogger to also forward logs to a central point too. if you are in a secure environment where you have to guarantee to retain all logs, then having the clog + local syslog + remote syslog is best. you may need to read this: http://permalink.gmane.org/gmane.comp.security.firewalls.pfsense.user/2990 and for the syslog-ng.conf: http://forum.pfsense.org/index.php/topic,7793.0.html | |||
|
feedback
|
|
Log rotation on FreeBSD is typically controlled with 'newsyslog'. You can edit the config file (/etc/newsyslog.conf) to control various aspects of how long logs are kept and how big the files may be kept. Read the man page for newsyslog for full details. | |||||||
feedback
|
