2.5.0 logging authentication

maverick_slo

Hi all.

I noticed that if I login and logout only sometimes my AUTH log shows that I logged in. There are lots of missing logins in the log file.

Right now I did 3 logins and 3 logouts and none were recorded.

jimp

Login and logout to what? The GUI? SSH? A VPN?

Does it show in the main system log but not the auth log?

maverick_slo

Hi.
Logging in to web gui.
It doesnt show in system or auth. If i do it from another ip it shows.
Openvpn is logged everytime correctly.

jimp

It may be syslogd suppressing what it thinks are duplicate messages if the content is identical to the previous instance.

maverick_slo

Maybe. But i think thats not ok.

jimp

If you logout and login fast enough to trigger the suppression then it's unlikely to be something shady, though. It will log a message saying something like last message repeated <number> times so it doesn't go completely unrecorded.

As you said if it comes from another address, it does get logged.

There is an option for syslogd to disable that throttling/compression but running it the other way could lead to even more problems.

maverick_slo

Nothing is logged about surpression.
But web gui nginx logs shows ok accesses confirming it was only me on the system...

maverick_slo

Disregard about surpression.
It is completley random, sometimes it logs and sometimes not. Nginx log for example shows i was clicking trough menu but auth log and syslog show nothing...

maverick_slo

Ok found pattern

Login, then logout then login again nothing logged.

Login, then logout AND press F5 then login, logged everytime

Cookies?

maverick_slo

Also failed logins are not logged.
Just upgraded to latest snap, same thing...

maverick_slo

Ssh logons are always correctly logged. So there is something borked somewhere, maybe php, nginx I dont know...

maverick_slo

Even worst...
Tried fresh 2.5.0

It does not log anything about webgui logon/logoff at all...

Not checked disable gui logging so it should be there.

maverick_slo

OK, so I guess there seems to be cache issue or something with my browser, tried from 2 different computers with firefox and I get same results, auth is not logged everytime.
Then I used Chrome, and it logs EVERY login / logout correctly.

??? :)

maverick_slo

Also fresh Firefox is working OK, just my 2 firefoxes (which I sync to them) are not being logged everytime but sporadically.

jimp

Maybe some browser add-on isn't actually removing your cookie when you logout? Or something similar.

When the browser actually logs out and back in, it gets logged. You appear to have some local problem and not a problem with the firewall.

maverick_slo

Well I did complete reset of browser and now it works correctly.

Thanks for suggestions!