Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    What determines how many logs are shown?

    Scheduled Pinned Locked Moved webGUI
    15 Posts 4 Posters 3.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      Eeeh… considered the possibility that there are just NOT enough log entries to fill the max?

      1 Reply Last reply Reply Quote 0
      • T
        Trel
        last edited by

        @doktornotor:

        Eeeh… considered the possibility that there are just NOT enough log entries to fill the max?

        There are 45 entries, it shows 36.
        The max unless I say otherwise is 50.

        Why is it NOT showing those 9?

        1 Reply Last reply Reply Quote 0
        • D
          doktornotor Banned
          last edited by

          Sigh. Ever considered that the number of log entries usually grows with time?

          1 Reply Last reply Reply Quote 0
          • K
            kejianshi
            last edited by

            Filter active?

            My logs are full of noise - Wish I had your problem.

            1 Reply Last reply Reply Quote 0
            • T
              Trel
              last edited by

              @doktornotor:

              Sigh. Ever considered that the number of log entries usually grows with time?

              Please stop assuming I'm an idiot.  The number is shrinking, not growing.

              Note the times in the attachments.

              pflog_01.jpg
              pflog_01.jpg_thumb
              pflog_02.jpg
              pflog_02.jpg_thumb

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                36 -> 45 is shrinking? Other than that, perhaps reading this would help: Why can't I view view log files with cat/grep/etc? (clog)

                Namely:

                The log files created for use by pfSense with clog are a fixed size that holds a certain amount of data total, not log entries.

                Sounds like you need bigger Log File Size.

                1 Reply Last reply Reply Quote 0
                • K
                  kejianshi
                  last edited by

                  What do you have in:

                  Status: System logs: Settings

                  GUI Log Entries to Display
                  Hint: This is only the number of log entries displayed in the GUI. It does not affect how many entries are contained in the actual log files.

                  I have 200 - Because I LOVE clutter (-:

                  1 Reply Last reply Reply Quote 0
                  • T
                    Trel
                    last edited by

                    @kejianshi:

                    What do you have in:

                    Status: System logs: Settings

                    GUI Log Entries to Display
                    Hint: This is only the number of log entries displayed in the GUI. It does not affect how many entries are contained in the actual log files.

                    I have 200 - Because I LOVE clutter (-:

                    I have it set to 50.  As you can see in the picture, when it's set to 50, it's showing 15.
                    When I manually put 500, it showed 80.  When I then removed the 500 filter, it showed 15.

                    1. I just changed it to 200, and it showed 26.
                    2. I manually typed in 200, and it showed 84.
                    3. I clicked the firewall tab (no postdata) and it showed 26 again.

                    1 Reply Last reply Reply Quote 0
                    • T
                      Trel
                      last edited by

                      @doktornotor:

                      36 -> 45 is shrinking? Other than that, perhaps reading this would help: Why can't I view view log files with cat/grep/etc? (clog)

                      No, but 45 -> 36 is.
                      However, the data is all there, and typing a number in the filter shows it.

                      I included two pictures that clearly show the discrepancy is moving in the opposite direction (eg: the number is getting smaller, not larger).

                      And I should point out that my log file size is set to 2,000,000 bytes.  I highly doubt that 80 entries is going to fill even close to that amount of data if it's plain text.

                      Disk space currently used by log files: 16M. Remaining disk space for log files: 406G.

                      EDIT: fixed number

                      1 Reply Last reply Reply Quote 0
                      • K
                        kejianshi
                        last edited by

                        Hmmm - Thats all I have on the subject.  No idea what is happening then.

                        1 Reply Last reply Reply Quote 0
                        • T
                          Trel
                          last edited by

                          I think before I debug any further, I'm going to backup my config and do a completely fresh install this weekend.

                          1 Reply Last reply Reply Quote 0
                          • K
                            kejianshi
                            last edited by

                            Thats a sane plan.

                            1 Reply Last reply Reply Quote 0
                            • P
                              phil.davis
                              last edited by

                              @Trel - you may not be crazy - ignore those other guys hassling you in this thread.
                              My system has the same behavior, when I go to the Firewall Log it shows me maybe 39 of max 100 entries.

                              clog /var/log/filter.log | tail -n 100

                              I have a bunch of firewall log entries in there for "igmp" (as well as other "normal" UDP and/or TCP and/or ICMP).
                              The backend code that parses filter.log to extract the details does not have code to handle IGMP and it is skipping those entries. Thus after it parses some chunk of the end of the file, it may end up with less than the max entries setting, even though there are plenty of lines in filter.log

                              Bug report: https://redmine.pfsense.org/issues/4343
                              Pull request: https://github.com/pfsense/pfsense/pull/1456

                              That change fixes it for me.

                              See if it fixes it for you.

                              If not, then look at the end of /var/log/filter.log and see what other entries are there with other protocols. I suspect that the code does not handle protocol 112 (CARP) entries either. But I do not have a CARP setup to try and log.

                              As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                              If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                              1 Reply Last reply Reply Quote 0
                              • K
                                kejianshi
                                last edited by

                                For the record - Never thought he was crazy.  Just couldn't locate the issue myself.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.