Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Last time updated?

    Scheduled Pinned Locked Moved ACME
    34 Posts 3 Posters 3.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • chudakC
      chudak @jimp
      last edited by

      @jimp

      I have Cron Entry enabled
      I see in Cron UI

      16	3	*	*	*	root	/usr/local/pkg/acme/acme_command.sh "renewall" | /usr/bin/logger -t ACME 2>&1
      

      I have NAT/WF rule on schedule

      Mon - Sun 3:15 3:30
      

      I check via Status > System Logs > General and filter Message for ACME
      ... and I see no traces of ACME executed in time range

      PS: Manually running ACME works fine

      You see something wrong with these steps ?

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        When did you last update the ACME package? I just put out the update with the log entry for cron in the last couple days. If you updated today, for example, you'd have no log entries for it yet.

        Also if your system log is especially busy, it may not go back far enough to show log entries from then.

        Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        chudakC 1 Reply Last reply Reply Quote 0
        • chudakC
          chudak @jimp
          last edited by chudak

          @jimp

          I am running ACME version 0.5.3.

          Is it good ?

          And cron says:

          | /usr/bin/logger -t ACME 2>&1
          

          and here see my log https://snag.gy/auomlf.jpg

          Maybe it will show up tomorrow ?

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            It might, but like I said, if your log is very busy it may have scrolled off before you checked.

            Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            chudakC 1 Reply Last reply Reply Quote 0
            • chudakC
              chudak @jimp
              last edited by

              @jimp

              that's an interesting point.

              But if you look at my log as above, you see ALL entries for 1/25/19, don't you? Where would it be ?

              Still consider show on the UI. I bet you majority of people would love that :)

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                The earliest it shows is 7:42 AM, the log entry would have been from 3:16 AM. It might have already fallen off the start of the circular log.

                Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                chudakC 1 Reply Last reply Reply Quote 0
                • chudakC
                  chudak @jimp
                  last edited by

                  @jimp

                  how ?

                  next you see

                  Jan 25 07:40:03	php-fpm		/acme/acme_certificates_edit.php: Beginning configuration backup to .https://acb.netgate.com/save
                  Jan 24 20:44:33	php		/usr/local/pkg/acme/acme_command.sh: End of configuration backup to https://acb.netgate.com/save (success).
                  

                  the day before yesterday, no ?

                  1 Reply Last reply Reply Quote 0
                  • jimpJ
                    jimp Rebel Alliance Developer Netgate
                    last edited by

                    Ah, sorry, I hate reverse logs, my brain always sees top=oldest.

                    Try searching with ACME in the process field, not the message.

                    Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    chudakC 2 Replies Last reply Reply Quote 1
                    • chudakC
                      chudak @jimp
                      last edited by chudak

                      @jimp

                      That's it !

                      Jan 25 03:16:00	ACME		Renewal number of days not yet reached.
                      Jan 25 03:16:00	ACME		Checking if renewal is needed for: YYY
                      Jan 25 03:16:00	ACME		Renewal number of days not yet reached.
                      Jan 25 03:16:00	ACME		Checking if renewal is needed for: XXX
                      

                      Thank you!

                      Still consider !!!

                      chudakC 1 Reply Last reply Reply Quote 0
                      • chudakC
                        chudak @jimp
                        last edited by chudak

                        @jimp

                        I also wanted to mention that after being using ACME for several days I say that you deserved kudos and thank you's for maintaining its code ....

                        1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan
                          last edited by Gertjan

                          Didn't had a look myself yet .... but it's there : exactly at 03h16 minutes sharp :

                          2019-01-25 03:15:54	Cron.Info	192.168.1.1	Jan 25 03:16:00 /usr/sbin/cron[87247]: (root) CMD (/usr/local/pkg/acme/acme_command.sh "renewall" | /usr/bin/logger -t ACME 2>&1)
                          2019-01-25 03:15:55	User.Notice	192.168.1.1	Jan 25 03:16:00 ACME: Checking if renewal is needed for: V2_brit-hotel-fumel.net
                          2019-01-25 03:15:55	User.Notice	192.168.1.1	Jan 25 03:16:00 ACME: Renewal number of days not yet reached.
                          

                          Btw : using an external syslogger.

                          edit : grepping using the magic word ( = ACME) nailed it in a split second.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 1
                          • chudakC
                            chudak @chudak
                            last edited by

                            @jimp

                            Just wondering when I see in logs those entries ("Renewal number of days not yet reached"), can I assume that NAT/FW rule for port forwarding was used and worked successfully?

                            1 Reply Last reply Reply Quote 0
                            • jimpJ
                              jimp Rebel Alliance Developer Netgate
                              last edited by

                              No, that is only a local check of the certificate expiration date

                              Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                              Need help fast? Netgate Global Support!

                              Do not Chat/PM for help!

                              chudakC 1 Reply Last reply Reply Quote 0
                              • chudakC
                                chudak @jimp
                                last edited by

                                @jimp

                                so how to enforce real check ? Renew via UI ?

                                1 Reply Last reply Reply Quote 0
                                • jimpJ
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by

                                  You can force it via the UI but that won't test your schedule since it's time-based.

                                  There isn't an easy way to test that until it runs again naturally.

                                  You could edit the cron job, add -force to the acme script call parameters, then wait overnight for the schedule to trigger, but that's not ideal either.

                                  Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  chudakC 1 Reply Last reply Reply Quote 0
                                  • chudakC
                                    chudak @jimp
                                    last edited by

                                    @jimp

                                    What if I lift schedule temporarily and run in command line:

                                    /usr/local/pkg/acme/acme_command.sh "renewall" --force
                                    
                                    1 Reply Last reply Reply Quote 0
                                    • jimpJ
                                      jimp Rebel Alliance Developer Netgate
                                      last edited by

                                      Just one dash -force.

                                      If you disable the schedule so the rule is always active, then it should work to test just the renew, but that still doesn't help you test the schedule or the cron job.

                                      Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                      Need help fast? Netgate Global Support!

                                      Do not Chat/PM for help!

                                      chudakC 1 Reply Last reply Reply Quote 0
                                      • chudakC
                                        chudak @jimp
                                        last edited by

                                        @jimp I realize this. My goal to test an odd port fowarding and it did seem to work.

                                        "Reload success" is this sufficient ?

                                        1 Reply Last reply Reply Quote 0
                                        • jimpJ
                                          jimp Rebel Alliance Developer Netgate
                                          last edited by

                                          If you see the cert in the list with an updated valid/expiration date, then yeah.

                                          Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                          Need help fast? Netgate Global Support!

                                          Do not Chat/PM for help!

                                          chudakC 1 Reply Last reply Reply Quote 0
                                          • chudakC
                                            chudak @jimp
                                            last edited by chudak

                                            @jimp

                                            Everything looks great and worked as expected.

                                            The only minor note

                                            I ran as:

                                            /usr/local/pkg/acme/acme_command.sh "renewall" -force | /usr/bin/logger -t ACME 2 > & 1
                                            
                                            Array
                                            (
                                                [path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
                                                [PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
                                                [port] => XYZ
                                                [ipv6] => 
                                            )
                                            ...
                                            [Wed Jan 30 10:11:14 PST 2019] Cert success.
                                            

                                            However when I filtered FW log for XYZ Destination Port I found nothing.

                                            Odd...

                                            GertjanG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.