Monitor Changes Made on PVE Firewall

[jackylian]

Hi, I am using Proxmox VE 5.4 and like to monitor events on the configuration made to Proxmox Firewall.
I have enabled whatever logging options I can find, but still unable to identify such events.

From the captured HTTP traffic, the configuration changes on PVE firewall will incur a POST to /api2/extjs/XXX/firewall URL.
However, I am unable to find such logs and need help to capture such events.

Any advice is greatly appreciated

 

[Chris]

Hi,
the firewall daemon will periodically check the config files for changes and generate the new rulesets from these, if there were any changes. So you could set up some script watching the files in /etc/pve/firewall/ and /etc/pve/nodes/nodename/host.fw