Pfsense Splunk universal Forwarder

[ozzbran]

Having a hard time getting Splunk Universal Forwarder to be installed on the pfSense Firewall for collecting firewall events. Is there any documentation. I'm using PFSENSE 2.1

[bradp123]

I was also able to get splunk running on pfsense. Here are some notes to make it easier for the next person who finds this post.

use fetch -o instead of wget. FreeBSD does not natively have wget.
create the opt directory. Splunk installs to the opt directory by default.
mkdir /opt

install the package using the FreeBSD pkg_add command
pkg_add splunkforwarder...

follow the splunk documentation
http://docs.splunk.com/Documentation/Splunk/6.1.1/Installation/InstallonFreeBSD

[my2ndhead]

Using syslog as the transport for firewall events is not a good idea, as the firewall events are multiline and syslog does not honour the time order. This will cause many garbled events.

In Version 1.0.1 of my TA-pfsense app (http://apps.splunk.com/app/1527/) I have experimented with using netcat to transport firewall events (custom filter.inc script => see README of that app). This has worked better, but not perfectly. I sometimes had unexplainable linefeeds inside events.

The Splunk Universal Forwarder does indeed work an a full pfsense 2.1 installation (in my case the 32-bit UF). It will probably not work on the NanoBSD/Embedded Version, due to read-only filesystems.

On my box I have installed the UF sucessfully with the FreeBSD pkg_add command.

[sbrant_splunk]

You'll probably need to send the firewall events to another device via syslog and ingest them into Splunk via a forwarder on that syslog aggregator.

https://doc.pfsense.org/index.php/Copying_Logs_to_a_Remote_Host_with_Syslog

[sbrant_splunk]

What is the architecture of your pfsense firewall? Given that the OS is a modified BSD, even running on an Intel CPU, it's probably not going to work. You'll be better off collecting syslog output from the pfsense firewall and ingesting that data into Splunk via a forwarder on the device collecting the syslog.