Syslog Webgui Log View Option

vallum

Is it possible to get rid of log display for service syslog-ng.
because with gb's of logs running it makes firewall utilize all CPU to display logs over GUI and commits suicide.

tim.mcmanus

@rootvallum said in Syslog Webgui Log View Option:

Is it possible to get rid of log display for service syslog-ng.
because with gb's of logs running it makes firewall utilize all CPU to display logs over GUI and commits suicide.

Log into the console and view logs from there. Virtually no performance hit doing it that way.

vallum

@tim-mcmanus said in Syslog Webgui Log View Option:

@rootvallum said in Syslog Webgui Log View Option:

Is it possible to get rid of log display for service syslog-ng.
because with gb's of logs running it makes firewall utilize all CPU to display logs over GUI and commits suicide.

Log into the console and view logs from there. Virtually no performance hit doing it that way.

When you click on syslog-ng , instead of opening configuration page it loads logs which causes this issue, why can't log display page be disabled? Who manage syslog-ng package

@jimp please give some input

stephenw10

How many log lines do you have it set to? Does that matter?

It should be pretty trivial change to make the link to the config page instead. Or maybe have the log page not actually open a log until you hit 'refresh' like the state table filter setting does.

Steve

stephenw10

You can edit the menu entry in the config as a temporary workaround or to test it.

		<menu>
			<name>Syslog-ng</name>
			<tooltiptext>Setup Syslog-ng</tooltiptext>
			<section>Services</section>
			<url>/pkg_edit.php?xml=syslog-ng.xml&amp;id=0</url>
		</menu>

Steve

vallum

@stephenw10 said in Syslog Webgui Log View Option:

How many log lines do you have it set to? Does that matter?

value is default 10, I have not changed it.

It should be pretty trivial change to make the link to the config page instead. Or maybe have the log page not actually open a log until you hit 'refresh' like the state table filter setting does.

Yeah that would be really helpful or maybe in configuration page new "option" for users to disable log view page .

Steve

Hi Stephen,
I hope you are doing okay :), when I started working with open-source firewalls you helped me a lot, I would like to thank you for your support and congratulations for getting promoted as Netgate Admin :)

I have configured syslog-ng to accept firewall filter logs and squid logs, daily log size is 5 Gb + and tons of lines get added every second.
I was able to fix this issue with logrotate service by truncating syslog-ng log file after every one hour but it caused some issues with firewall going to read only mode(don't know it behaved like that).
I have observed via TOP command that after clicking syslog-ng service, "sort" process consumes all cpu.

vallum

@stephenw10 said in Syslog Webgui Log View Option:

You can edit the menu entry in the config as a temporary workaround or to test it.
		<menu>
			<name>Syslog-ng</name>
			<tooltiptext>Setup Syslog-ng</tooltiptext>
			<section>Services</section>
			<url>/pkg_edit.php?xml=syslog-ng.xml&amp;id=0</url>
		</menu>
Steve

Okay Steve I will try this and update you.

stephenw10

There is now a package update available with that change in it. You should see it in package manager. Let me know if you see any problems.

Steve

vallum

@stephenw10 said in Syslog Webgui Log View Option:

There is now a package update available with that change in it. You should see it in package manager. Let me know if you see any problems.

Steve

Thanks Steve, I'll update you soon.