WebGUI populates syslog when dashboard running



  • I'm currently running pfSense 2.3.1-RELEASE-p5 and have found it writing all WebGUI requests to syslog. I've unchecked the Log errors from the web server process under the Status/System Logs/Settings menu but this hasn't stopped it from writing log entires.

    21/06/2016	21:12:50	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:50 +1000] "GET /system_advanced_admin.php HTTP/1.1" 200 6144 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:49	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:49 +1000] "GET /widgets/widgets/dyn_dns_status.widget.php?getdyndnsstatus=yes HTTP/1.1" 200 78 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "POST /widgets/widgets/interface_statistics.widget.php HTTP/1.1" 200 329 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /ifstats.php?if=ovpnc2 HTTP/1.1" 200 65 "https://pfsense.host.net/graph.php?ifnum=opt3&ifname=OPT3&timeint=10&initdelay=4" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /ifstats.php?if=lagg0_vlan50 HTTP/1.1" 200 64 "https://pfsense.host.net/graph.php?ifnum=opt1&ifname=OPT1&timeint=10&initdelay=2" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /ifstats.php?if=lagg0_vlan55 HTTP/1.1" 200 65 "https://pfsense.host.net/graph.php?ifnum=opt2&ifname=OPT2&timeint=10&initdelay=2" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /ifstats.php?if=igb5 HTTP/1.1" 200 68 "https://pfsense.host.net/graph.php?ifnum=wan&ifname=WAN&timeint=10&initdelay=2" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /ifstats.php?if=lagg0_49 HTTP/1.1" 200 66 "https://pfsense.host.net/graph.php?ifnum=lan&ifname=LAN&timeint=10&initdelay=2" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "POST /widgets/widgets/gateways.widget.php HTTP/1.1" 200 227 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /graph.php?ifnum=opt3&ifname=OPT3&timeint=10&initdelay=4 HTTP/1.1" 200 10532 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /graph.php?ifnum=opt1&ifname=OPT1&timeint=10&initdelay=2 HTTP/1.1" 200 10546 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /graph.php?ifnum=opt2&ifname=OPT2&timeint=10&initdelay=2 HTTP/1.1" 200 10546 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /graph.php?ifnum=lan&ifname=LAN&timeint=10&initdelay=2 HTTP/1.1" 200 10542 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:47	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:47 +1000] "GET /graph.php?ifnum=wan&ifname=WAN&timeint=10&initdelay=2 HTTP/1.1" 200 10528 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:46	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:46 +1000] "POST /widgets/widgets/gateways.widget.php HTTP/1.1" 200 224 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    21/06/2016	21:12:46	Information	pfsense.host.net	local5	nginx	10.X.X.X - - [21/Jun/2016:21:12:46 +1000] "GET / HTTP/1.1" 200 16739 "https://pfsense.host.net/" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0"
    
    


  • Hi,

    Your are 'syslogging' to a remote syslog server, right ?
    I see the same thing. Since nginx came on board, the entire web server log is send to the remote syslog server.

    I found a work solution : do not visit the web GUI - which often happens, because when the box has been set up, it doesn't need you attention anymore.
    Better solution : an option to exclude normal (GUI) web server traffic is missing on the system log page.



  • Yes I am remote logging.

    While I would love not to have to visit the webGUI I've been troubleshooting my setup so unfortunately that is not an option. I also like to review the logs and webGUI regularly for any issues.



  • After setting up a new rsyslog-server (CentOS 7) this week, i see the same behaviour. It must be something completely different from standard because i set up rsyslog to truncate the domain name. That works for all messages, except those submitted by nginx on pfSense.

    It clutters up the log results and i think there should be a fix for this.

    We have six pfSense 2.3.2 boxes, of which five are full installs and one is a nano image with VGA.

    The same problem is reported here: https://forum.pfsense.org/index.php?topic=112880.0