Retrieve pfSense/freeBSD logs with elk

I am attempting to centralize logs from different systems.

I installed the Elastick Stack (Elasticsearch, Logstash, Kibana) and WAZUH OSSEC on one server (named elk).

I have installed the OSSEC agent on three ubuntu server and I am able to check logs and file integrity.

However, how could I also get logs from a pfSense ? I tried installing OSSEC agent by compiling it, but it is not so easy... I was thinking to do it via remote syslog, but it doesn't seem to be working...

On the pfSense Interface -> Status -> System Logs -> Settings I put the address and port of my elk in the remote log server field, and I added this in /var/ossec/etc/ossec.conf of elk :

<remote>
    <connection>syslog</connection>
    <port>514</port>
    <protocol>udp</protocol>
    <allowed-ips>192.168.2.0/24</allowed-ips>
    <local_ip>192.168.2.4</local_ip>
</remote>

But I don't get any logs of my pfSense when I visualize them with Kibana... Do you know how to make it work?

Try running tcpdump to actually confirm you have traffic coming from your pfSense device. For example you could run something like:

tcpdump -nni eth0 port 514 -s 0 -AA 

That will show you the packet header and payload.

Try also checking that ossec-remoted process is listening for incoming traffic. You can do it by running:

netstat -nap | grep 514

In addition, as another option that I personally like, you can use (on the Wazuh server) Rsyslog daemon to collect Syslog data and dump it into a file.

Then you can configure the Wazuh server logcollector component to read that log file, so it is also processed by Wazuh and the analysis engine.

A good tool to monitor if Rsyslog is writing to the file and if ossec-logcollector component is reading it is running lsof. Example:

lsof /var/log/your_syslog_file.log

To use Rsyslog you will need to configure it to listen for remote data, and a rule to write logs to the file. An example of a rule would be:

if ($fromhost == '192.168.98.1') and ($msg contains 'pfSense') then -/var/log/your_syslog_file.lgo

If you go this way, to avoid conflict, remember to disable ossec-remote sysl