Need help with two weird System Log messages
-
Checking out my system log, I'm seeing two strange messages. Can anyone explain these?
The first is "pflog0: promiscuous mode enabled"
This is a fairly fresh install and I'm not running Snort or anything other utility that would automatically turn promiscuous mode on as mentioned here: https://doc.pfsense.org/index.php/What_are_%22promiscuous_mode_enabled%22_log_messages Any ideas why this would turn on by itself?
The second is multiple time errors regarding an "illegal attempt to update time." What does this mean?
Again, could someone explain this?
Thanks!
-
1. That's pflog not a typical network interface. The message is from filterlog attaching to receive pf log messages. Nothing wrong there.
2. Looks like your clock went backwards
-
Thanks for the response. Could you please explain #1? Also, any idea why my clock would go backwards? It's not something I did, myself.
-
not much more to say about #1. pf sends its log data to the pflog device. It shows in ifconfig, but it's not a network interface. filterlog latches onto it like tcpdump would to read the raw log data from pf. When filterlog starts, you see that message. It's a normal message, not unusual/weird.
As for the clock, tough to say. It might have run ahead and been reset back by NTP, or it may have been accurate before and wrong now. Run the timestamps through a unix time converter to see what they come out as.
-
On #2, this is RRD objecting to time running backwards. The first timestamp is recent (May 10th), while the second timestamp is from back in January. It may be that the current time has not yet been set after boot. I see this happen with power cycling systems that do not have a battery backed clock. It goes away once NTP is synchronized.
