OPNsense Forum

Archive => 19.1 Legacy Series => Topic started by: anotheruser on March 21, 2019, 03:38:03 pm

Title: Proxy not sending data to Syslog
Post by: anotheruser on March 21, 2019, 03:38:03 pm

Hello!

Im testing an Opnsense installation with Captive portal and transparent proxy.

Im using an upgraded installation of opnsense (18->19), squid was not sending data to syslog, so i upgrade it to 19.1 and the problem remains.

The syslog server works, i can receive messages from other components, like the firewall or the dhcp, but i can't get a single line from squid proxy.

Where should i look?

Thanks

Title: Re: Proxy not sending data to Syslog
Post by: franco on March 21, 2019, 09:06:21 pm

Hi there,

Services: Web Proxy: Administration: General Proxy Settings.

Click "advanced mode".

Set "Log target" to "Syslog".


Cheers,
Franco

Title: Re: Proxy not sending data to Syslog
Post by: anotheruser on March 21, 2019, 11:25:44 pm

It's on, i'm not receiving any lines. That's why im posting here.  ::)

Title: Re: Proxy not sending data to Syslog
Post by: franco on March 22, 2019, 07:59:24 am

Works for me: logs are redirected to Services: Captive Portal: Log File. I'm not sure why but that's what it is.

And you can forward "Portal Auth events" remotely then (System: Settings: Logging).


Cheers,
Franco

Title: Re: Proxy not sending data to Syslog
Post by: anotheruser on March 22, 2019, 03:25:07 pm

Franco: I I can receive everything from every service, except from proxy. Yes i have the authentication events from the captive portal. I works. DCHCP, Firewall, you name it. Those are OK. But Squid is not.

If i go to the proxy settings and set the loggin mode to FILE, i can see the lines on the GUI, so squid is actually loggin the users activity. but if i set it to SYSLOG, i receive nothing. Squid does not send a single line to my syslog.

Also, it seems im not the only one.

https://forum.opnsense.org/index.php?topic=8497.0 (https://forum.opnsense.org/index.php?topic=8497.0)

Title: Re: Proxy not sending data to Syslog
Post by: franco on March 24, 2019, 01:16:01 pm

I repeat. The squid access log messages when Syslog is enabled in web proxy are being sent to *Services: Captive Portal: Log File*.


Cheers,
Franco

Title: Re: Proxy not sending data to Syslog
Post by: netranger on April 28, 2019, 06:29:35 pm

Quote from: franco on March 22, 2019, 07:59:24 am

Works for me: logs are redirected to Services: Captive Portal: Log File. I'm not sure why but that's what it is.

And you can forward "Portal Auth events" remotely then (System: Settings: Logging).


Cheers,
Franco

Hi guys,
sorry I'm probably misunderstanding something obvious here. But does this mean in order to get the squid logs into my syslog server I need to activate the Captive Portal (which I'm not using)?
I can see the squid logs in the captive portal page and "Portal Auth events" forwarding is activated, but I don't get those logs at my syslog server.

Thank you and good start into the week,
NR

Title: Re: Proxy not sending data to Syslog
Post by: franco on April 30, 2019, 07:42:59 am

If you raise a ticket I can take a closer look.

https://github.com/opnsense/core/issues/new/choose


Cheers,
Franco

Title: Re: Proxy not sending data to Syslog
Post by: netranger on April 30, 2019, 06:15:39 pm

Quote from: franco on April 30, 2019, 07:42:59 am

If you raise a ticket I can take a closer look.

https://github.com/opnsense/core/issues/new/choose

Ticket created! https://github.com/opnsense/core/issues/3454

I'll be happy to provide more configs or log files if you need them. Thanks a lot for looking into this.

Cheers,
NR

Title: Re: Proxy not sending data to Syslog
Post by: anotheruser on July 16, 2019, 02:20:01 am

Hi, currently using 19.1.10 and i still can't send the proxy data to syslog. Ticking the checkmark does nothing and
the access lines are forwarded to the gui, on the access tab. No lines on the syslog.

Thanks.