pfSense logs not showing in Wazuh

grep filterlog /var/ossec/logs/archives/archives.log | tail -n 3

/var/ossec/bin/wazuh-logtest

Why it happens

Cause 1: a single block is not logged, by design

The stock rules in ruleset/rules/0540-pfsense_rules.xml on 4.14.7:

The comment above 87701 in that file reads "We don't log firewall events, because they go to their own log file." Pass events stop at 87700, level 0. So with stock rules, a working pfSense integration shows nothing in the dashboard until someone hammers one address 18 times in 45 seconds.

We sent one BSD block line over UDP syslog to a 4.14.7 manager: it reached archives.log, and alerts.json stayed empty. We sent 18 within the window in wazuh-logtest: the 18th came back as 87702, level 10.

Note: wazuh-logtest prints "Alert to be generated" for 87701 even though the running manager does not write it. Logtest does not apply no_log; check alerts.json, not logtest, for this case.

Cause 2: RFC 5424 lines match no decoder

The stock pf decoder is keyed on <program_name>filterlog</program_name>, which Wazuh's pre-decoder takes from a BSD-style header (host program[pid]:) or from an ISO timestamp followed by host program[pid]:. An RFC 5424 header (1 <timestamp> <host> filterlog <pid> - -) is not split that way: no program name, so no decoder, so no rule. In archives.log the line even shows the manager's own host name instead of the firewall's, because the header was not parsed.

Fix

1. Send BSD format. In pfSense, Status → System Logs → Settings, set the log message format to BSD (RFC 3164) and save. New lines decode as pf immediately; no manager change needed. If a central syslog server sits in between and rewrites to RFC 5424, fix it there, or you need a custom decoder for that header.

2. Decide which block events you want as alerts. To alert on every single block, overwrite 87701 without no_log in /var/ossec/etc/rules/local_rules.xml:

<group name="local,pfsense,">
  <rule id="87701" level="5" overwrite="yes">
    <if_sid>87700</if_sid>
    <action>block</action>
    <description>pfSense firewall drop event.</description>
    <group>firewall_block,pci_dss_1.4,gpg13_4.12,hipaa_164.312.a.1,nist_800_53_SC.7,tsc_CC6.7,tsc_CC6.8,</group>
  </rule>
</group>

Run /var/ossec/bin/wazuh-analysisd -t, then restart the manager. On 4.14.7 this loaded with no warnings, and the same single block line that produced nothing before produced one 87701 alert in alerts.json.

Be careful with volume: a firewall on the internet blocks a lot. Many teams prefer a narrower child rule instead, for example only blocks on an internal interface or to a sensitive port, and leave 87701 as it is.