My company is being required to retain firewall logs for 1 year, so I figured the easiest route would be remote logging to the unraid server.
I've read a ton of how-to's and guides that all claim it's a fairly simple process. Either it's not, or I'm just dumb. My bet is the latter. ;)

So far, I have syslog-ng installed and (I think) running on the server.
I've configured the pfsense box to enable remote logging, and have pointed it at the syslog-ng IP:port.
I also tried setting up a docker for Graylog, but I don't think it's working. At least I can't get to any sort of webGUI for it, and don't know what else I'm supposed to do with it.

Can someone please provide (or point me to) a super simple setup guide for how to do remote logging?
I just want the pfsense box to dump its logs onto a folder on the server. That's it. It can do it forever, and I'll manually manage them, if I have to.
Of course any fancy GUIs or management tools would just be bonus.
Diagnostics attached, in case they are of any use.

aeserver-diagnostics-20260831-1942.zip

Just tested some stuff I found for this. What I have is not using the pfsense package. I created a share in Unraid called syslogs for this. It is writing logs to my syslogs share now. You will have to tinker with the setting in pfsense to get the filesize and rotation to a spot that you need, shouldn't be too tough.

GL

******copied slop from www********

On pfSense

1. Go to Status → System Logs → Settings tab.

2. Under Remote Logging Options, check "Send log messages to remote syslog server".

3. Fill in:

   • Source Address – usually "Default (any)" unless you're using a specific interface (e.g., a VPN tunnel).

   • IP Protocol – IPv4 (or IPv6).

   • Remote Log Servers – enter up to 3 servers in ip:port format (default port 514).

4. Under Remote Syslog Contents, check the categories you want forwarded (Firewall, System, DNS, DHCP, VPN, etc.).

5. Click Save.

Logs will immediately start flowing to the remote server.

****My PFS Status>System Logs>Settings********

*********more copied slop********

On Unraid (receiving server)

Unraid has a built-in syslog server — no extra packages needed.

1. Go to Settings → Syslog Server in the Unraid web GUI.

2. Set Local syslog server to Enabled (opens a UDP listener on port 514).

3. Under Local syslog folder, select a share — ideally one that writes to an SSD/NVMe (cache drive) to avoid wear on spinning disks.

4. Configure rotation (e.g., 50 MB max file size, 4–10 files).

5. (Optional) Set Remote syslog server to the Unraid server's own IP — this "loopback trick" ensures Unraid's own system logs also get written to that share.

6. Click Apply.

Logs from remote devices will appear in the selected share, one file per remote host (named by hostname or IP depending on the System identifier setting).

**********

This is absolutely amazing, and exactly what I was hoping for, THANK YOU!

Just one little hiccup... it doesn't seem to be working. lol
I followed all the steps (I think), and it all looks fine, except that no log files are being created on the server in my new share.

What can I provide to help diagnose?

set the share to public to ensure its not a write permission thing

Edited 3 hours ago3 hr by Veah

Just now, Veah said:

set the share to public to ensure its tva write permission thing

Yup

Edited 3 hours ago3 hr by Elmojo

If your settings match my screenshots and still not working, I do not know what else.

I dunno, I think it all looks good. Did I miss anything?

WHOA, hang on. Files just popped in! I have no idea why they took so long to appear, since the firewall has been logging traffic all this time.
Is there some sort of "write interval" that's applied? How often does it update?

In any case, it appears to be working. :D

1 minute ago, Elmojo said:

Is there some sort of "write interval" that's applied? How often does it update?

In any case, it appears to be working. :D

Dunno, dunno and great news.

Just now, Veah said:

Dunno, dunno and great news.

Right? Sometimes these things just do what they want. ;)

Thanks again for your help. Thread SOLVED.

Now my next task is figuring out how to access the pfsense GUI over tailscale, so I can admin it remotely... I never ends. lol