pfsense interface and gateway metrics to pfelk - working solution #487
robeweber
started this conversation in
Show and tell
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I was very much interrested in also getting regular updates on the state of all used interfaces from pfSense on pfELK.
VictorRobellini's telegraf_pfifgw.php script was my starting point.
However I did not want to use telegram and I did not want it to output influx formatted output.
So I changed the PHP code to be used by the cron plugin of pfSense (install this package if you want to also use this).
Download the newly created PHP script:
(https://github.com/robeweber/pfelk/blob/main/pfsense_interfaces.php)
In pfSense, upload the script using the "Upload File" section:
![image](https://private-user-images.githubusercontent.com/23274427/251639684-4ab143ea-08d4-4ba0-8ba8-8982bfab9fcf.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxNTE4MzIsIm5iZiI6MTcyNjE1MTUzMiwicGF0aCI6Ii8yMzI3NDQyNy8yNTE2Mzk2ODQtNGFiMTQzZWEtMDhkNC00YmEwLThiYTgtODk4MmJmYWI5ZmNmLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDE0MzIxMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWUwZDFkNDdjZTU3YjA3NzUwN2NkYWEyMjc1MTMxZmY2NzljYWFjM2QwMTk0ZDZlM2U4ZGM1NmY3NzllYWMyMDYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.Q_wZJRdqRhM3QGTm15qR20jS7N3pa6dRlt1qdoLvs4g)
pfSense will display the path where it has uploaded the file to.
It will most likely be /tmp/pfsense_interfaces.php
Using the "Execute Shell Command" on the same page of pfSense, execute the following code to move it to the right place:
mv /mnt/pfsense_interfaces.php /usr/local/bin/pfsense_interfaces.php
I have set the timing to the maximum possible I could figure out:
![image](https://private-user-images.githubusercontent.com/23274427/251637871-3f83f484-09b2-4701-a258-78f5b9b331b1.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjYxNTE4MzIsIm5iZiI6MTcyNjE1MTUzMiwicGF0aCI6Ii8yMzI3NDQyNy8yNTE2Mzc4NzEtM2Y4M2Y0ODQtMDliMi00NzAxLWEyNTgtNzhmNWI5YjMzMWIxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTIlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEyVDE0MzIxMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTUyMDkxNjdkYzYxYzA2ODY1YjBhNmM3MzE0OTJlNzQ0ODk2OTQ0NmQwZTAzMDY2YTcxYWIwN2ZmYTVlNWY3MTMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.4T0CxEUz6EztHMSGBkT0tkGm2EEV02WVFAsmO4ifrko)
Set Command to the following:
/usr/local/bin/php-cgi -f /usr/local/bin/pfsense_interfaces.php | /usr/bin/nc YOURPFELKIP 5057
Set logstash to also listen on port 5057. For that I have written a new conf.d pfelk file:
03-input-pfsense-metrics.pfelk
Add the GROK patterns in patterns/pfelk.grok:
Add the following two new sections in:
conf.d/05-apps.pfelk
And add the two following "else if" statements just before the "else" statement in:
in the Kibana dashboard, after the first data has been sent to elasticsearch, you will have to create two new "Data Views" in order to see the data in the Discover tab:
And you are done and enjoy.
I have now uploaded all files as I am using them at this moment.
https://github.com/robeweber/pfelk/tree/main
Only download and overwrite them in your setup if you have not changed anything else yourselves in them and only if you follow all the steps of (#486) and #487
Beta Was this translation helpful? Give feedback.
All reactions