Where are pfsense log files?

Where can the pfsense log files be located and viewed?

I have searched the documentation and it doesn't indicate the log files location for the various components of pfsense.

As of pfSense 2.5+, logging has changed. There is no longer a clog utility; they're all just plain-text files., though they're still all located at /var/log. It appears that all existing/prior logs are deleted during the upgrade; at least I couldn't find the old logs after the upgrade (and this behavior doesn't seem to be referenced in the ticket).

pfSense® software version 2.5.0 uses plain text log files which can be used by a variety of traditional shell utilities.

The firewall periodically rotates log files to keep their size in check. The rotation behavior is controlled by the log settings (Log Rotation Settings). There is one main log file, plus a number of rotated log files. The rotated log files are compressed by default. The GUI understands each compression option and will display and search contents of rotated log files in addition to the main log file. This adds processing time but vastly increases the amount of log data available to the GUI.

pfSense® software versions older than 2.5.0 use a binary circular log format known as clog to maintain a constant log size without the need for rotation. As syslogd writes new entries to a clog file, it removes older entries automatically. As such, the older data is lost.

In the nanobsd 2.0.3 release at least, they are found by going to:

• cd /var/log (not plural logs ;)
• clog system.log | less
  • Replace system.log with name of any log in the directory.
  • Because these log files are not regular text files, but are actually binary circular logs, then the clog utility is used to view them and | less pipes the output to less so that you can scroll up and down through the logs using page up/down keys. Press q to exit.
• When you are done viewing logs and want to return from the shell prompt back to the pfsense menu, type exit at the command prompt.

pfSense stores its log files in the /var/log directory.

The logs are not stored in the standard text-based format. Instead they are stored in a 'circular logging' format. Use the clog tool to view the logs. You can use it similarly to the tail command. i.e. clog -f /var/log/system.log will display the entire log and then continue to 'follow' it.

Simpler way of looking at logs - log into the pfsense web console and Select 'Edit File' within 'Diagnostics'. Here you can browse the directory /var/log/system.log.

Example: