Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    2.5.1-RELEASE - Dashboard's "Firewall logs" widget kills the CPU and effectively DoS's the GUI

    Scheduled Pinned Locked Moved General pfSense Questions
    33 Posts 6 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      e-1-1 @Gertjan
      last edited by

      @gertjan Aha! Roger that.

      So it looks like an empty general "Log Rotation Size (Bytes)" actually leads to a whooping

      var/log: less ../etc/newsyslog.conf.d/pfSense.conf | egrep filter
      /var/log/filter.log		root:wheel	600	7	2097151.3671875	*	C
      
      

      How it ended up like that, might've found out below
      .
      I set the general parameter in the GUI to 512000, now pfSense.conf has still (?!) that "2097151.3671875" value for /var/log/filter.log. Set it to 1048576 like in your example, still "2097151.3671875".
      Digging deeper, in the firewall log's own "Log Rotation Size (Bytes)" parameter, found value "2147483000". Culprit found, value deleted, "1048576" is now shown as a fading grey text.
      Saved, waited a couple of minutes, pfSense.conf still showing "2097151.3671875". Manually set to 512000, saved => pfSense.conf shows "500". OK so far.

      Then cleared "Log Rotation Size (Bytes)", leaving the washed out default value. Save=> pfSense.conf still shows "500". It gets this from the general setting, right? Then I guess "1048576" should not be shown at all greyed out in the firewall tab, but a hint be present that if it's not set, it gets the general default or user-defined setting.

      1 Reply Last reply Reply Quote 0
      • E
        e-1-1 @jimp
        last edited by

        @jimp Appreciate it.

        As for the "quick mode" log parsing, if I may add a point - the "read only X parsable lines" for me is applicable only in two cases:

        1. the dashboard firewall widget that by default gets the last few logs, sorted by time from the newest. Zero need afaik to parse more than those
        2. the default (freshly opened, no filters) firewall log in both normal and dynamic view.

        For the rest, parse away :|.

        On the efficiency, log volume and "central log server" topic I agree. It's a waste of time to use anything else than dedicated distributed log aggregation, indexing and searching clusters, for example. However, in regulated and air gapped environments, I can't use pfSense, no matter how much I would like to. It's simply not "enterprise-y" enough. Left some feedback last year on this subject in the web form, I hope it sparked some discussions internally. Won't detail here, it's simply too many features to list and it's off-topic.

        1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate
          last edited by

          The firewall log tosses out log entries which are very spammy and useless in some cases (like some IPv6 multicast entries which get dropped by default rules and are practically worthless), so it has to fetch significantly more than we really want to ensure there is enough data.

          Guess too low and we get a ton of user complaints about "why is it only showing me 20 entries when I set it to 50" and so on.

          Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          AKEGECA 1 Reply Last reply Reply Quote 0
          • AKEGECA
            AKEGEC @jimp
            last edited by

            @jimp thanks for all your hard work. Have you thought about Wireguard concept (less is more). This concept could be a game-changer for pfSense dev team.

            GertjanG 1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @AKEGEC
              last edited by

              @akegec said in 2.5.1-RELEASE - Dashboard's "Firewall logs" widget kills the CPU and effectively DoS's the GUI:

              Have you thought about Wireguard concept

              That's an understatement.
              I guess jimp has thought a lot about Wireguard recently.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              AKEGECA 1 Reply Last reply Reply Quote 0
              • AKEGECA
                AKEGEC @Gertjan
                last edited by

                @gertjan it would be wise if pfsense team apologize and involve Jason A. Donenfeld to the project 2.6. To behave like a gentleman could bring back the trust of former pfsense fans/users back.

                GertjanG 1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  I have no idea what "less is more" might mean for logging, but the rest of that is off topic for this thread.

                  We already try to take a minimalist approach to support for logging. There are numerous logging features like reporting, collation, alerts, etc which we won't add because it's not the right place for them. Those things belong on a log server, no matter how many people try to convince us they belong on a firewall because they don't want to setup a log server.

                  Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @AKEGEC
                    last edited by Gertjan

                    @akegec
                    Why ?
                    To who ?
                    Some one was blessed, hurt ? At risk ?
                    For trying to add something new ?
                    And finding out that "when it's done", people start looking at it, and the 'code' just starts its actual "life cycle of updates, upgrades, changes" span. Nothing's new here neither.

                    Maybe, pfSense and TNSR should use very conservative design rules, but, its (free) software, so they can put things in, and take things out if needed, when they see fit.

                    Yes, I've read the story. saw the blogs, Youtube video's and others.
                    All I know, is that I know close to nothing about it. So, finally, what I "think" is meaningless, and stays in my head.

                    One thing for sure, I didn't lost 'trust', not for a moment.

                    Anyway, this has nothing to do with "Dashboard's "Firewall logs" widget kills the CPU and effectively DoS's the GUI"

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @Gertjan
                      last edited by johnpoz

                      @gertjan said in 2.5.1-RELEASE - Dashboard's "Firewall logs" widget kills the CPU and effectively DoS's the GUI:

                      Anyway, this has nothing to do with "Dashboard's "Firewall logs" widget kills the CPU and effectively DoS's the GUI"

                      Exactly..

                      One thing for sure, I didn't lost 'trust', not for a moment.

                      Agree 110% here..

                      Could things of been handled better in the public eye. Maybe.. I don't really concern myself with squabbles like that.. All kinds of stuff can get said in the heat of the discussion.. On both sides.. But just at a loss to what that has to do with the topic at hand anyway..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      E 1 Reply Last reply Reply Quote 0
                      • E
                        e-1-1 @johnpoz
                        last edited by

                        @johnpoz From my side, this topic can be closed. Root causes of the issues were found and several improvements in business logic and documentation are on the public redmine backlog.

                        1 Reply Last reply Reply Quote 0
                        • jimpJ jimp locked this topic on
                        • jimpJ
                          jimp Rebel Alliance Developer Netgate
                          last edited by

                          Agreed. Locking it down. Can start a new thread if other ideas come up.

                          Remember: Upvote with the ๐Ÿ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.