Where are pfsense log files?

Question

Where can the pfsense log files be located and viewed?

I have searched the documentation and it doesn't indicate the log files location for the various components of pfsense.

Solution 1

As of pfSense 2.5+, logging has changed. There is no longer a clog utility; they're all just plain-text files., though they're still all located at /var/log. It appears that all existing/prior logs are deleted during the upgrade; at least I couldn't find the old logs after the upgrade (and this behavior doesn't seem to be referenced in the ticket).

pfSense® software version 2.5.0 uses plain text log files which can be used by a variety of traditional shell utilities.

The firewall periodically rotates log files to keep their size in check. The rotation behavior is controlled by the log settings (Log Rotation Settings). There is one main log file, plus a number of rotated log files. The rotated log files are compressed by default. The GUI understands each compression option and will display and search contents of rotated log files in addition to the main log file. This adds processing time but vastly increases the amount of log data available to the GUI.

pfSense® software versions older than 2.5.0 use a binary circular log format known as clog to maintain a constant log size without the need for rotation. As syslogd writes new entries to a clog file, it removes older entries automatically. As such, the older data is lost.

Solution 2

In the nanobsd 2.0.3 release at least, they are found by going to:

• cd /var/log (not plural logs ;)
• clog system.log | less
  • Replace system.log with name of any log in the directory.
  • Because these log files are not regular text files, but are actually binary circular logs, then the clog utility is used to view them and | less pipes the output to less so that you can scroll up and down through the logs using page up/down keys. Press q to exit.
• When you are done viewing logs and want to return from the shell prompt back to the pfsense menu, type exit at the command prompt.

Solution 3

pfSense stores its log files in the /var/log directory.

The logs are not stored in the standard text-based format. Instead they are stored in a 'circular logging' format. Use the clog tool to view the logs. You can use it similarly to the tail command. i.e. clog -f /var/log/system.log will display the entire log and then continue to 'follow' it.

Solution 4

Simpler way of looking at logs - log into the pfsense web console and Select 'Edit File' within 'Diagnostics'. Here you can browse the directory /var/log/system.log.

Example:

View more solutions

Comments

[mwfearnley]

This answer is almost too beginner-friendly for someone I'd trust with console access to a pfSense device.

[AaronLS]

@mwfearnley Guess you don't have to worry since no one here is asking you for access. That said, circular logs aren't super common that I'd expect everyone to be familiar with them off the cuff.

[mwfearnley]

Yes, the clog info is helpful.

[mwfearnley]

Looking back, my initial comment wasn't very constructive.. Giving the location (indirectly) and advising to use clog / less are very useful. But using cd to change directories should be known already, and is actually not needed, since you can do clog /var/log/system.log directly. Also, just to say this is information still works up to at least v2.4 on FreeBSD.

[mwfearnley]

Yes, the log file is mostly plain text, but it's actually stored in a "circular log" - it's a fixed-size file - with a small binary footer. There is a "cursor position" tracked in the file, that resets to the start when the file reaches the end. This means that the oldest entry will likely be somewhere in the middle of the file, and the first line will be wrapped around from the end. The clog tool is the recommended way to view them.