Remote Log server

[jclendineng]

I have the elk stack on a remote server.  I cannot seem to get opnsense to forward traffic to it.  I was able to use barnyard2 with pfsense, do we have a feature that will allow remote log management?

[nines]

I've configured remote ips logging to elk via filebeat on opnsense, works great. The last thing I've to find out is how to autostart filebeat on opnsense but the logging functionality works without issues


Gesendet von iPhone mit Tapatalk

[fabian]

You can go to system settings and configure Logstash as a remote syslog server. works good, but not with all logs. If you can use the standard port for OPNsense, just drop this file into your server directory and start your LS instance: https://github.com/fabianfrz/opnsense-logstash-config (requires my filter reader plugin)

[jclendineng]

I am running my instance in docker, Id assume this would only work on a non-docker host.

[fabian]

Docker should not be a problem. In worst case you can build a new image based on the official one with the addition.

[jclendineng]

I still have not been successful in sending syslogs to my server