All Apps and Add-ons

Pfsense Splunk universal Forwarder

ozzbran
Engager

Having a hard time getting Splunk Universal Forwarder to be installed on the pfSense Firewall for collecting firewall events. Is there any documentation. I'm using PFSENSE 2.1

Tags (1)

bradp123
Path Finder

I was also able to get splunk running on pfsense. Here are some notes to make it easier for the next person who finds this post.

use fetch -o instead of wget. FreeBSD does not natively have wget.
create the opt directory. Splunk installs to the opt directory by default.
mkdir /opt

install the package using the FreeBSD pkg_add command
pkg_add splunkforwarder...

follow the splunk documentation
http://docs.splunk.com/Documentation/Splunk/6.1.1/Installation/InstallonFreeBSD

my2ndhead
SplunkTrust
SplunkTrust

Using syslog as the transport for firewall events is not a good idea, as the firewall events are multiline and syslog does not honour the time order. This will cause many garbled events.

In Version 1.0.1 of my TA-pfsense app (http://apps.splunk.com/app/1527/) I have experimented with using netcat to transport firewall events (custom filter.inc script => see README of that app). This has worked better, but not perfectly. I sometimes had unexplainable linefeeds inside events.

The Splunk Universal Forwarder does indeed work an a full pfsense 2.1 installation (in my case the 32-bit UF). It will probably not work on the NanoBSD/Embedded Version, due to read-only filesystems.

On my box I have installed the UF sucessfully with the FreeBSD pkg_add command.

sbrant_splunk
Splunk Employee
Splunk Employee

You'll probably need to send the firewall events to another device via syslog and ingest them into Splunk via a forwarder on that syslog aggregator.

https://doc.pfsense.org/index.php/Copying_Logs_to_a_Remote_Host_with_Syslog
0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

What is the architecture of your pfsense firewall? Given that the OS is a modified BSD, even running on an Intel CPU, it's probably not going to work. You'll be better off collecting syslog output from the pfsense firewall and ingesting that data into Splunk via a forwarder on the device collecting the syslog.

0 Karma
Get Updates on the Splunk Community!

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...