Send pfSense+ logs to promtail

Networking & Firewalls
1

I’d like to send my pfSense logs to promtail. I have it setup, seems to be connecitng, but I don’t see any data. Wondering if I need some firewall rules to address the current state SINGLE:NO_TRAFFIC?

pfTop: Up State 1-2/2 (907), View: default, Order: bytes
PR        DIR SRC                           DEST                                   STATE                AGE       EXP     PKTS    BYTES
udp       Out 10.0.3.1:514                  10.0.3.38:9080                     SINGLE:NO_TRAFFIC   03:35:42  00:00:28    16881  3546076
udp       Out 10.0.3.1:53546                10.0.3.38:9080                     SINGLE:NO_TRAFFIC   00:01:35  00:00:30       15     2026
2

I have not used promtail before but sending pfsense logs to our SIEM and to Graylog works without any special rules.

3

I think I figured it out - mostly. I think logs are streamed in UDP so I had to setup rsyslog as a relay. And 9080 isn’t really the port either, I setup promtail to listen on 1514 and its seems to be working fine.