mbierman/addremotesyslog.sh

bn1980 · 2024-01-11T05:35:41Z

Can this be used to get Firewalla gold networking blocks and IDS in to Wazuh?

mbierman · 2024-01-15T02:13:15Z

@bn1980 I assume so. It looks like Wazuh supports syslog input.

tsqrd · 2024-01-30T02:46:31Z

@mjaestewart This has worked great, but inevitably the zeek events stop streaming because I think zeek rotates those logs and then rsyslog doesn't pick up the change and is reading from the wrong inode. Have you seen this same behavior? How were you able to handle it? I don't see a logrotate conf for the zeek logs, so I assume it's the builtin zeek functionality for rotation.

mjaestewart · 2024-01-30T03:53:12Z

@mjaestewart This has worked great, but inevitably the zeek events stop streaming because I think zeek rotates those logs and then rsyslog doesn't pick up the change and is reading from the wrong inode. Have you seen this same behavior? How were you able to handle it? I don't see a logrotate conf for the zeek logs, so I assume it's the builtin zeek functionality for rotation.

I’ll put together a solution tomorrow and post it :-) Yes, I also see the same behavior.

mbierman · 2024-01-30T05:32:32Z

@mjaestewart if you find a solution I'd love to test and incorporate it.

mjaestewart · 2024-01-30T20:06:09Z

@mbierman and @tsqrd

Here is my updated solution. I've tested all day, and so far so good. @mbierman I reused what you had already done, and built on that 👍

Script

#!/bin/bash
# v 2.1.0

script_location="/home/pi/.firewalla/config/post_main.d/" # script location
script="firewalla_rsyslog.sh" # script used to install firewalla syslog
cron_cmd="0 * * * * cd $script_location && sudo ./$script -c"
syslog="/etc/rsyslog.d/09-externalserver.conf" # rsyslog location
server="172.16.2.20" # Change the server to the IP of your syslog server.
port="514" # port used for forwarding logs to destination
protocol="tcp" #use tcp or udp
other_protocol="@@" # use @@ for TCP and @ for UDP
valid=$(grep "$server:$port" $syslog 2>/dev/null)



### Creating the syslog file

create() {
	sudo touch $syslog
	sudo cat > $syslog <<EOF
	
\$LocalHostName Firewalla
# deifne global workDirectory for saving the state file of log messages.
global(workDirectory="/var/spool/rsyslog")

# enable the Rsyslog imfile module processing text files or logs.
module(load="imfile" PollingInterval="10")


# define template for StandardSyslogFormat for processing log messages.
# that will be forwarded to rsyslog server
template(
    name="StandardSyslogFormat"
    type="string"
    string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
    )


# define ruleset "forwardSysLogs" with action object to send logs to rsyslog server
# define the queue
ruleset(name="forwardSysLogs") {
    action(
        type="omfwd"
        target="$server"  # set your Synology Syslog Server NAS IP
        port="$port"  # Specify port number
        protocol="$protocol"  # specify protocol UDP or TCP
        template="StandardSyslogFormat"  # specifies the template to use above

        queue.SpoolDirectory="/var/spool/rsyslog"
        queue.FileName="remote"
        queue.MaxDiskSpace="1g"
        queue.SaveOnShutdown="on"
        queue.Type="LinkedList"
        ResendLastMSGOnReconnect="on"
        )
        stop
}

# define input files forwardSysLogs logs to send to the rsyslog server
# and apply ruleset "forwardSysLogs" 
# in /bspool/manager

input(type="imfile" ruleset="forwardSysLogs" Tag="ConnLog" File="/bspool/manager/conn.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="ConnLongLog" File="/bspool/manager/conn_long.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="DNS" File="/bspool/manager/dns.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="Files" File="/bspool/manager/files.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="HeartBeat" File="/bspool/manager/heartbeat.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="NTP" File="/bspool/manager/ntp.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="OSCP" File="/bspool/manager/oscp.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="SSL" File="/bspool/manager/ssl.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="StdErr" File="/bspool/manager/stderr.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="StdOut" File="/bspool/manager/stdout.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="HTTP" File="/bspool/manager/http.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="Notice" File="/bspool/manager/notice.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="Weird" File="/bspool/manager/weird.log")

# define input files forwardSysLogs logs to send to the rsyslog server
# and apply ruleset "forwardSysLogs" 
# in /alog

input(type="imfile" ruleset="forwardSysLogs" Tag="ACL-Alarm" File="/alog/acl-alarm.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="ACL-Audit" File="/alog/acl-audit.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="DNS-Masq" File="/alog/dnsmasq-acl.log")

# define input files forwardSysLogs logs to send to the rsyslog server
# and apply ruleset "forwardSysLogs" 
# in /alog/firewalla

input(type="imfile" ruleset="forwardSysLogs" Tag="FireApi" File="/alog/firewalla/FireApi.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="FireKick" File="/alog/firewalla/FireKick.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="FireMain" File="/alog/firewalla/FireMain.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="FireMon" File="/alog/firewalla/FireMon.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="FireRouter" File="/alog/firewalla/FireRouter.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="Trace" File="/alog/firewalla/Trace.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="CleanLog" File="/alog/firewalla/clean_log.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="Firelog" File="/alog/firewalla/firelog.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="Node" File="/alog/firewalla/node.log")
input(type="imfile" ruleset="forwardSysLogs" Tag="SyncTime" File="/alog/firewalla/sync_time.log")

# Sending all other Syslog logs to Server (Synology) 
# @@IP is for TCP
# @IP is for UDP
*.* $other_protocol$server:$port
EOF

    echo "Restarting rsyslog..."
    sudo systemctl restart rsyslog
    echo "remote syslog added"
    echo "adding cron job for reliability"
    (crontab -u pi -l 2>/dev/null; echo "$cron_cmd") | crontab -u pi -
    sudo systemctl restart cron
    exit
}

cleanup() {
	sudo rm -f $syslog
	sudo systemctl restart rsyslog
	(crontab -u pi -l | grep -vF "$cron_cmd" | crontab -u pi -)	
}

if [ -f "$syslog" ] ; then
	if [ -n "$valid" ] ; then
	echo "remote syslog already in place with $server:$port specified"
	case $1 in
		-c)
		echo -e "\nrecreating syslog configuration..." 
		cleanup
		create
		;;
  		-r|-restart|-force|-f)
                echo "Restarting rsyslog..."
                sudo systemctl restart rsyslog
		exit
		;;
		-u|-update)
			read -p "Are you sure you want to remove the syslog forwarder? type 'y' " -n 1 -r
			echo
			if [[ $REPLY =~ ^[Yy]$ ]] ; then
				ls $syslog 2>/dev/null && cleanup || echo -e "\n\nNo log found.\n"
			fi
			exit
		;;
		-h)
		echo -e "You can use:\n     - \`$0 -c\` recreate forwarding\n     - \`$0 -r\` restart the syslog service\
		\n     - \`$0 -u\` uninstall the settings to send to the remote syslog server\n\n"
    		exit
		;;
	esac
	else
		echo "The server is not configured correctly. On it." 
		cleanup
		create
	fi
else
	echo "There was no syslog forwarder in place."
	create
fi

Fixes

Hostname is now set to Firewalla
Cron is now used to ensure persistent sending of all FW logs
Implementation is now completely automated via script

Setting up the Directory

To send logs to a remote syslog server using UDP, do the following:

ssh to the Firewalla box.
Copy the script above.
If /home/pi/.firewalla/config/post_main.d/ doesn’t exist, create it first.
sudo mkdir /home/pi/.firewalla/config/post_main.d/
Next, create the file:
sudo vi /home/pi/.firewalla/config/post_main.d/firewalla_rsyslog.sh

Modifying the Variables in the Script and Executing

Edit the following variables in the script for your specific environment:
1. server to the IP address of your syslog server.
2. port to the correct port being used for rsyslog
3. protocol to specify TCP or UDP
4. other_protocol uses a single @ for UDP and a double @@ for TCP
Paste this script into firewalla_rsyslog.sh. This is going to create rsyslog configs and the cron job that runs to ensure that the syslog setting remains in place, even if there's a firewalla update that wipes out the settings in the future.
Save the file :wq!
Give the script execute permissions.
sudo chmod +x /home/pi/.firewalla/config/post_main.d/firewalla_rsyslog.sh
Execute the script.
sudo /home/pi/.firewalla/config/post_main.d/firewalla_rsyslog.sh -c creates the file and restarts syslog

Additional Arguments

/home/pi/.firewalla/config/post_main.d/firewalla_rsyslog.sh -r restarts syslog
/home/pi/.firewalla/config/post_main.d/firewalla_rsyslog.sh -u uninstalls the forwarder and restarts syslog.

mjaestewart · 2024-01-30T20:17:28Z

tsqrd · 2024-02-23T15:46:33Z

@mjaestewart Do you end up with an endless supply of imfile state files in /var/spool/rsyslog? I ended up adding a cronjob to delete files older than 5 minutes in that directory because otherwise it just fills up indefinitely. I'm assuming it has something to do with zeek truncating/rotating the log files because I also end up with these messages from rsyslogd in /var/log/syslog: imfile: internal error? inotify provided watch descriptor 3745 which we could not find in our tables.

tsqrd · 2024-02-28T21:55:00Z

You may also want to consider this post about persisting cron through reboots/restarts: https://help.firewalla.com/hc/en-us/articles/360054056754-Customized-Scripting

I notice the cronjob disappeared after a reload so I added it to the location described by that article.

nickt444 · 2025-03-30T03:43:13Z

@mjaestewart @mbierman
thanks a lot for sharing this - just what I was looking for.
I'm curious why you need the cron job to run the create function every hour.
According to https://help.firewalla.com/hc/en-us/articles/360054056754-Customized-Scripting, scripts in post_main.d run every time the Firewalla restarts. Couldn't the script just check for the presence of the .conf file and create it if not present? Or are there conditions where the config can get deleted without a restart to add the config back?

mbierman · 2025-03-30T05:31:27Z

@nickt444 ,

In my version, there is no need for a cron job. I feel it is a bad idea to restart syslog every hour. I'm not sure I follow what problem that was trying to solve. The current code is not how Firewalla recommends creating cron jbos. I haven't tested to see if it works anyway. Maybe in a round about way it still works but there's no reason to do it this way.

I haven't tested the modified version. The fact that it seems to need a cronjob makes me cautious about it for now. When I get a chance I may try to fix a few things and see if it has any adverse effects if the cron isn't run.

viroid · 2025-04-22T01:23:25Z

I've been playing with a Graylog server in my home lab, as a result, I started looking into how to export the Bro(Zeek) logs from the Firewalla to Graylog.

I was using the following script via a cron job every minute, found it on Reddit.

#!/bin/bash for l infind /log/blog/ -type f -mmin -1 ;do zcat $l | sed "s|\}|,\"firewalla_log\":\"$l\"}|g" | nc -q 5 192.168.25.200 514 -w0;done

I ran across this Gist, and tried to use @mjaestewart script, this appears to pickup and re-send all exsiting logs each time rsyslog is restarted, which probably isn't a problem normally, but if you are fiddling, I'm finding that it's dumping 6k logs in a second and then my graylog server queue starts piling up.

imfile appears to support a 'freshStartTail' option, how would I include it in mjaestewart's script? would it get added as a parameter on the input line?

input(type="imfile" ruleset="forwardSysLogs" Tag="ConnLog" File="/bspool/manager/conn.log" freshStartTail="on")

mbierman/addremotesyslog.sh

bn1980 commented Jan 11, 2024

Uh oh!

mbierman commented Jan 15, 2024

Uh oh!

tsqrd commented Jan 30, 2024

Uh oh!

mjaestewart commented Jan 30, 2024

Uh oh!

mbierman commented Jan 30, 2024

Uh oh!

mjaestewart commented Jan 30, 2024 •

edited

Loading

Uh oh!

mjaestewart commented Jan 30, 2024

Uh oh!

tsqrd commented Feb 23, 2024

Uh oh!

tsqrd commented Feb 28, 2024

Uh oh!

nickt444 commented Mar 30, 2025

Uh oh!

mbierman commented Mar 30, 2025

Uh oh!

viroid commented Apr 22, 2025

Uh oh!

	#!/bin/bash
	# v 2.1.0

	syslog=/etc/rsyslog.d/09-externalserver.conf
	# this logs notice and above. use . log everything.
	filter=*.notice
	server=192.168.0.19 # Change the server to the IP of your syslog server.
	port=514
	hostname=firewalla
	valid=$(grep "$server:$port" $syslog 2>/dev/null)

	create () {
	# To use TCP uncomment line 14 to use TCP and comment line 16
	# echo -e "# remote syslog server (TCP):\n$filter @@$server:$port" \| sudo tee $syslog
	# Line 16 assumes UDP: to use TCP, comment the line 16 and uncomment line 14
	echo -e "# remote syslog server (UDP):\n\$LocalHostName $hostname\nfilter @$server:$port" \| sudo tee $syslog
	echo "Restarting rsyslog..."
	sudo systemctl restart rsyslog
	echo "remote syslog added"
	exit
	}

	cleanup () {
	sudo rm -f $syslog
	sudo systemctl restart rsyslog
	}

	if [ -f "$syslog" ] ; then

	if [ -n "$valid" ] ; then

	echo "remote syslog already in place with $server:$port specified"

	case $1 in
	-c)
	echo -e "\nrecreating syslog configuration..."
	cleanup
	create
	;;

	-r\|-restart\|-force\|-f)
	echo "Restarting rsyslog..."
	sudo systemctl restart rsyslog
	exit
	;;

	-u\|-update)
	read -p "Are you sure you want to remove the syslog forwarder? type 'y' " -n 1 -r
	echo

	if [[ $REPLY =~ ^[Yy]$ ]] ; then
	ls $syslog 2>/dev/null && cleanup \|\| echo -e "\n\nNo log found.\n"
	fi
	exit
	;;

	-h)
	echo -e "You can use:\n - \`$0 -c\` recreate forwarding\n - \`$0 -r\` restart the syslog service\
	\n - \`$0 -u\` uninstall the settings to send to the remote syslog server\n\n"
	exit
	;;
	esac

	else
	echo "The server is not configured correctly. On it."
	cleanup
	create
	fi
	else
	echo "There was no syslog forwarder in place."
	create
	fi

mbierman/addremotesyslog.sh

bn1980 commented Jan 11, 2024

Uh oh!

mbierman commented Jan 15, 2024

Uh oh!

tsqrd commented Jan 30, 2024

Uh oh!

mjaestewart commented Jan 30, 2024

Uh oh!

mbierman commented Jan 30, 2024

Uh oh!

mjaestewart commented Jan 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Script

Fixes

Setting up the Directory

Modifying the Variables in the Script and Executing

Additional Arguments

Uh oh!

mjaestewart commented Jan 30, 2024

Uh oh!

tsqrd commented Feb 23, 2024

Uh oh!

tsqrd commented Feb 28, 2024

Uh oh!

nickt444 commented Mar 30, 2025

Uh oh!

mbierman commented Mar 30, 2025

Uh oh!

viroid commented Apr 22, 2025

Uh oh!

mjaestewart commented Jan 30, 2024 •

edited

Loading