Adding OPNsense Firewall via Syslog

Updated October 15, 2026 05:46

Purpose

This guide explains how to forward OPNsense firewall logs to Logsign USO over syslog. The integration covers the packet filter verdicts that OPNsense writes with the filterlog program (pass, block, rdr, nat and binat, for IPv4 and IPv6) and the IPsec messages of the strongSwan daemon charon.

Prerequisites

Administrator access to the OPNsense web interface.
Network connectivity from OPNsense to the Logsign USO collector on your syslog port (TCP or UDP 514 by default).
A Logsign USO release that includes the OPNsense Firewall parser. Contact Logsign Support if you are not sure which release you run.
Logging enabled on the firewall rules you want to see in Logsign USO. OPNsense only writes a filterlog line for rules that have the Log option turned on.

Step 1: Add a Remote Syslog Target in OPNsense

Menu names can differ between OPNsense releases. If the steps below do not match your web interface, check the logging section of the OPNsense documentation for your release.

Log in to the OPNsense web interface.
Go to System > Settings > Logging and open the Remote tab.
Click + to add a new destination and enable it.
Set Transport to UDP or TCP (IPv4), enter the IP address of the Logsign USO collector as Hostname and set Port (514 by default).
Leave Applications, Levels and Facilities empty to send everything, or select at least the firewall (filter) and IPsec applications.
Tick rfc5424. This is optional, but recommended (see Supported Message Formats).
Save and apply the settings.

Step 2: Add the Data Source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select OPNsense as the vendor and Firewall as the product, and enter the IP address of the OPNsense device as the host. Click Save. Repeat this for every firewall. Once a device starts sending, events appear under Search.

Supported Message Formats

OPNsense sends RFC 3164 (BSD) syslog by default and RFC 5424 when the rfc5424 box of the remote target is ticked. Logsign USO parses both formats. Both carry the host name, the program name, the process ID and the message text.

1 2026-10-13T12:01:56+00:00 fw01.example.com filterlog 85700 - [meta sequenceId="69372"] 69,,,cde33a90424d2c632cf6faba73f9aa4c,em0,match,pass,out,4,0x0,,63,56842,0,DF,6,tcp,52,192.0.2.10,198.51.100.20,18856,443,0,S,2810616444,,64240,,mss;nop;nop;sackOK;nop;wscale
Oct 13 12:01:56 fw01.example.com filterlog[85700]: 69,,,cde33a90424d2c632cf6faba73f9aa4c,em0,match,pass,out,4,0x0,,63,56842,0,DF,6,tcp,52,192.0.2.10,198.51.100.20,18856,443,0,S,2810616444,,64240,,mss;nop;nop;sackOK;nop;wscale
1 2026-10-13T12:02:10+00:00 fw01.example.com charon 61234 - [meta sequenceId="69380"] 05[NET] <con1|9> sending packet: from 192.0.2.1[500] to 203.0.113.5[500] (80 bytes)

The RFC 5424 timestamp includes the time zone. The RFC 3164 timestamp has no year and no time zone. For this reason we recommend RFC 5424.

Notes and Limits

Only filterlog and charon messages are parsed. Messages from other OPNsense programs (for example the web GUI, sshd, configd, OpenVPN, Unbound or Suricata) are not parsed by this integration and do not appear as OPNsense Firewall events. To save bandwidth, you can limit the remote target to the firewall and IPsec applications.
OPNsense writes one line for each logged packet decision, so a busy firewall can send a high volume. Turn on the Log option only for the rules you need, and take the volume into account when you plan EPS.
If you use RFC 3164, set the OPNsense clock to the same time zone as Logsign USO so that Time.Generated is correct.
Rule.ID holds the rule label, not the rule number. Rule numbers change when the rule set reloads. The label stays the same.

Verification

In Logsign USO, open Settings > Data Collection and confirm that the OPNsense Firewall source is receiving data.
Generate traffic that matches a rule with logging turned on. In Logsign USO, go to Search and look for events with Vendor OPNsense and Product Firewall. A passed connection appears with EventMap Network / Session / Allow and a blocked one with Network / Session / Deny.
If the source is receiving data but no events show Vendor OPNsense, check that the remote target sends the firewall application and that the messages are not changed by a relay.