Hey Support,
We’re currently running into an issue ingesting OpenVPN logs into our Rapid7 SIEM.
Current Setup:
OpenVPN is running on our pfSense firewall
Logging is enabled on pfSense for OpenVPN
pfSense is forwarding logs via syslog to our Rapid7 SIEM
Issue:
At the moment, no OpenVPN-specific logs are appearing in Rapid7. The only logs we’re seeing are general firewall/network traffic logs — nothing related to:
User VPN connections
Session disconnects
Connection timeouts
So basically, the SIEM is getting traffic logs, but not the actual OpenVPN event logs.
Troubleshooting Done:
Increased OpenVPN verbosity level
Verified syslog forwarding from pfSense
Reviewed OpenVPN syslog documentation (Access Server), but we are not using OpenVPN Access Server, just pfSense OpenVPN
What We Need:
We’re trying to get proper OpenVPN event logging into Rapid7, specifically:
User connect/disconnect events
Session duration / timeout logs
Questions:
Is there a specific way pfSense needs to forward OpenVPN logs (separate facility or filter)?
Are OpenVPN logs on pfSense categorized differently than standard firewall logs in syslog?
Do we need to enable additional logging or packages on pfSense to expose these events?
Is there a recommended log format or parser configuration on Rapid7 for OpenVPN via pfSense?
Any guidance on getting full OpenVPN log visibility into Rapid7 would be appreciated.
Thanks.
