Problem with log viewer
-
Hi, I have searched the forums and have not found an answer to my issue, so if I missed it somehow, please point me in the right direction.
I am running the 1.2RC2 version and the problem I am having is when I view the logs, I only see between 25-300 or so entries, yet in the settings I have selected to display 2000 log entries. This problem only manifests itself in the firewall logs, all the other log tabs seem to behave okay. When I view the raw log entries, I see them all, so I know the logs are there. Is this a problem with the way logs are displayed in the viewer, or is it a problem in the way log entries are parsed for viewing? Also, am I the only one having this problem?
This may be part of the problem, I see the following filling up lots of space in my logs, and I am not sure what it means or why it is there, can anyone enlighten me?
Sep 18 18:36:15 pf:
Sep 18 18:36:15 pf:
Sep 18 18:36:15 pf: WARNING: Short packet. Try increasing the snap length
Sep 18 18:36:15 pf: Name=
Sep 18 18:36:15 pf: QuestionRecords:
Sep 18 18:36:15 pf: AddressRecCount=0
Sep 18 18:36:15 pf: AuthorityCount=0
Sep 18 18:36:15 pf: AnswerCount=0
Sep 18 18:36:15 pf: QueryCount=1
Sep 18 18:36:15 pf: Rcode=0
Sep 18 18:36:15 pf: NmFlags=0x11
Sep 18 18:36:15 pf: OpCode=0
Sep 18 18:36:15 pf: TrnID=0x812D
Sep 18 18:36:15 pf: >>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCASTI was previously running m0n0wall, and never had this problem with viewing the logs, so I am not sure if the problem is resident in previous versions of pfSense or not.
Except for this one issue, I love pfSense, it is everything I loved about m0n0wall, with some additional features that I really like, GREAT JOB to the developers!
-
I have this problem too.
If it helps I am using 3com nics on a CARP system with the mtu on the wan reduced to 1412 for IPSEC RDP use
-
Same issue here. Drives me wild.
-
I'm not sure if the count issue is related to that pflog snaplen problem, but I've opened a ticket on that particular issue. I haven't seen any log display counting issues in at least a year if not more.
tacfit: Are you seeing the short packet warning, or the wrong log count, or both, or?
-
@cmb:
tacfit: Are you seeing the short packet warning, or the wrong log count, or both, or?
I haven't checked the system log, so I don't know about the short packet warning, I'm definetly seeing a wierd log count though. It jumps from 20 entries to maybe 100, no matter what value I set.
-
Thank you for opening the ticket, I guess I will just have to wait and see what comes back on it. I don't code well (okay, so I don't code at all), but I am willing to test if you need me to. Let me know if there is anything I can do. Again, thank you!
-
billm has committed a fix for this to the newer snapshots (and RC3)
2007-Oct-05 17:52:51 by billm:
Committed a potential fix (works for me), please test.It works fine for me my logs are now displaying fine
Thanks
-
Thanks for the confirmation, morbus.
-
I'd like to add that upgrading to 1.2 RC-3 has fixed all the log viewer issues I was previously having. Six boxes fixed and counting…... :)