Firewall logs
Log monitoring for linked firewalls: what's collected, searching and filtering, the plain-language quick look, the alerts logs raise, retention and limits.
Updated
On this page
RevoSecure collects the logs of every linked pfSense and OPNsense firewall, explains them in plain language, keeps them searchable for your workspace's retention period, and raises an alert when a line matters. It's the part of a SIEM an MSP uses day to day: what hit the firewall, who signed in to it, did the IDS fire, is the internet connection dropping.
What's collected
Log collection is on by default for every firewall. The collector sends new log lines with every report (every 5 minutes), signed with the firewall's own key over HTTPS, like everything else it sends. Nothing to set up on the firewall: collector 1.1.0 ships logs as soon as RevoSecure asks for them, and older collectors update themselves to 1.1.0 within the hour.
| Source | What it holds |
|---|---|
| Firewall rules | Traffic the firewall blocked, and allowed traffic for rules that have logging turned on |
| Logins | Sign-ins to the web interface and SSH (successful and failed), sshguard, sudo |
| OpenVPN | VPN sign-ins, connections and disconnections |
| IPsec | Tunnels coming up and going down, failed authentication |
| Gateways | The internet connection monitor (dpinger): packet loss and latency alarms |
| IDS / IPS | Suricata or Snort alerts, if the package is installed |
| System | General system messages |
A source the firewall doesn't have (no VPN, no IDS package) is simply skipped. Turn collection off, or choose the sources, on the firewall's Settings tab under Log collection.
Searching
Logs in the navigation (shown once a customer has a firewall) lists the lines newest first, for one customer in the customer workspace or for all customers. The firewall's own page has a Logs tab scoped to it.
- Time range: the last hour to the last 30 days (up to your retention). Click a bar of the chart to zoom into it.
- Blocked / Allowed and the source chips narrow the list.
- Addresses, ports and users are filters: click one anywhere (in the list, the quick look or the side panels) to
show only its lines. An address filter also accepts a network, for example
192.168.1.0/24. - Search matches the raw text of the lines, over the newest 7 days of the range.
- Export downloads the filtered lines as CSV, newest first (up to 50,000 lines or 32 MB; if the range held more, the file's last line says so). Exports are recorded in the audit log.
The tiles and side panels summarise the newest 7 days of the range: blocked traffic and the addresses behind it, the most targeted ports, sign-in activity, IDS signatures.
The quick look
Click a line to open it. RevoSecure explains it in one sentence, for example Blocked inbound TCP from 185.220.101.9:51514 to 203.0.113.10 port 3389 (RDP) on WAN, by the default deny rule, using the firewall's own configuration for interface and rule names. Below it: what this kind of line means and whether it needs anything, every field (each clickable as a filter), and the raw line exactly as the firewall wrote it.
Blocked traffic from the internet is normal background noise: scanners probe every address on the internet all day. It doesn't need action and never raises an alert.
Times and time zones. Most firewall logs write local times without a time zone, so RevoSecure reads them in the firewall's own time zone (from its report). Twice a year that isn't exact: when daylight saving time ends, one hour happens twice and a time in it could be either; when it begins, one hour is skipped and a time in it never happened as written. Lines in those hours, and lines with no readable time at all (shown with the time RevoSecure received them), keep a best-effort time for searching and say so in the quick look. They still count towards totals such as an IDS signature's count, but RevoSecure never uses them for alerts that depend on timing (failed sign-ins within 15 minutes, scans within 10) or to reopen an alert you resolved.
Alerts from logs
These raise security events (source Firewall logs) in Alerts, with the usual notifications (high and critical only, to the people who opted in). Each alert has View the log lines, which opens the matching search.
| Alert | When | Severity |
|---|---|---|
| Firewall admin login from the internet | A successful web interface or SSH sign-in from a public address (VPN users signing in are expected and don't count) | High |
| Password guessing on the firewall | 20 or more failed web, SSH or VPN sign-ins from one address within 15 minutes | Medium; high from 200 |
| IDS alert | An IDS alert of priority 1 (high) or 2 (medium), grouped per signature and source per day; once 10 or more addresses fire a signature in a day, they become one alert for the signature | High or medium |
| Device scanning the network | A device inside the network blocked towards 50 or more ports, or 30 or more hosts, within 10 minutes (blocks on the internet side don't count) | High |
Repeats add to the same alert instead of creating new ones. A dismissed alert stays quiet unless it gets worse. Lines that arrive late or out of order (a firewall catching up after being offline) can at worst make RevoSecure miss something; they never raise a false alert or close a real one.
Internet connection outages are alerted by firewall monitoring, from the gateway status the firewall reports every few minutes (see the firewall's Monitoring tab). The gateway log lines show the detail (packet loss and latency alarms, and when the connection recovered), and you can search them here.
Snort writes IPv6 addresses and ports without brackets (2606:4700::1111:1000), and for some compressed IPv6
addresses that can be read two ways: one address, or an address and a port. RevoSecure doesn't guess. Such an alert
is still stored and still raises its signature's alert, but shows no source address and doesn't count towards "from
10+ addresses". Suricata's alerts (EVE JSON) keep addresses and ports apart, so they're always exact.
Retention and limits
- Lines are kept for 30 days by default. Owners and admins can choose 7, 14, 30 or 90 days in Settings → Workspace & branding → Firewall log retention. Shortening it deletes older lines in the background; lengthening it keeps lines longer from then on. Alerts are kept regardless.
- At most 2 million lines per firewall per day are stored. Beyond that, firewall-rule lines are counted but not stored (sign-ins, VPN, IDS and gateway lines still are), and the firewall shows Daily limit reached. The usual cause is an allow rule with logging turned on; turn its logging off on the firewall.
- After a long outage the collector catches up on a bounded backlog and skips the rest. RevoSecure then says some lines weren't collected, and how much.
- Moving a firewall to another customer moves its stored lines too; removing it deletes them.
Who can see logs
Technicians, analysts, admins and owners (the same people as Alerts). Customer portal users never see logs. Log lines are protected by the same workspace isolation as all your data, and aren't shared with the AI assistant. Neither are your log searches: when you ask the assistant something from the Logs page, it only learns the time range, the firewall and the kinds of lines you picked, never the text you searched for or the user, address or signature you clicked.