TUI for viewing and analysing OPNsense filter/firewall logs

[patient0]

ou can now open multiple files or pipe data via stdin, and it all shows up in one view like it's a single log.

Perfect, thanks. I don't have 40G of logs, that won't be an issue for me :)

[allddd]

One feature I would find helpful is the inclusion of the rule descriptions, ideally in the main view or at least in the details view and also when '-j' option is used.

I've looked into it and it'd be nice, but the filter log doesn't contain the description. The only thing I can think of is to use the rule id from the log to somehow find the description somewhere else.

/conf/config.xml has descriptions of rules you've added manually, but default rules aren't there. The rules in there are also referenced by a uuid, not by the rule id from the log. I don't know of any other place that has the rule id and the description (of all rules).

If anyone knows a better way to do this, I'd be open to adding this.

[lmoore]

/conf/config.xml has descriptions of rules you've added manually, but default rules aren't there. The rules in there are also referenced by a uuid, not by the rule id from the log. I don't know of any other place that has the rule id and the description (of all rules).

Before posting the other day, I searched my firewall for another file containing the rule UUID and Description fields. The only other file I located on the system which contains the information, and is current, is /tmp/rules.debug. The GUI Live View is obtaining the information from somewhere.

Unless someone can advise where Live View obtains the information, perhaps creating and using a database reference file from either /tmp/rules.debug or the API, and regenerating it when a time-stamp changes.

On a side note, last Saturday I added a new VLAN interface to my system and enabled a DHCP server on it then included it to an existing Firewall Group. Later in the day I noticed some unexpected entries in Live View where a rule logs the allowed connection and then another line logged immediately after, which references an unrelated block rule. These entries also appeared in opnsense-filterlog. To overcome the problem OPNsense was rebooted.