2.5.0 logging authentication

[maverick_slo]

Hi all.

I noticed that if I login and logout only sometimes my AUTH log shows that I logged in. There are lots of missing logins in the log file.

Right now I did 3 logins and 3 logouts and none were recorded.

[jimp]

Login and logout to what? The GUI? SSH? A VPN?

Does it show in the main system log but not the auth log?

[maverick_slo]

Hi.
Logging in to web gui.
It doesnt show in system or auth. If i do it from another ip it shows.
Openvpn is logged everytime correctly.

[jimp]

It may be syslogd suppressing what it thinks are duplicate messages if the content is identical to the previous instance.

[maverick_slo]

Maybe. But i think thats not ok.

[jimp]

If you logout and login fast enough to trigger the suppression then it's unlikely to be something shady, though. It will log a message saying something like last message repeated <number> times so it doesn't go completely unrecorded.

As you said if it comes from another address, it does get logged.

There is an option for syslogd to disable that throttling/compression but running it the other way could lead to even more problems.

[maverick_slo]

Nothing is logged about surpression.
But web gui nginx logs shows ok accesses confirming it was only me on the system...

[maverick_slo]

Disregard about surpression.
It is completley random, sometimes it logs and sometimes not. Nginx log for example shows i was clicking trough menu but auth log and syslog show nothing...

[maverick_slo]

Ok found pattern

Login, then logout then login again nothing logged.

Login, then logout AND press F5 then login, logged everytime

Cookies?

[maverick_slo]

Also failed logins are not logged.
Just upgraded to latest snap, same thing...

[maverick_slo]

Ssh logons are always correctly logged. So there is something borked somewhere, maybe php, nginx I dont know...

[maverick_slo]

Even worst...
Tried fresh 2.5.0

It does not log anything about webgui logon/logoff at all...

Not checked disable gui logging so it should be there.

[maverick_slo]

OK, so I guess there seems to be cache issue or something with my browser, tried from 2 different computers with firefox and I get same results, auth is not logged everytime.
Then I used Chrome, and it logs EVERY login / logout correctly.

??? :)

[maverick_slo]

Also fresh Firefox is working OK, just my 2 firefoxes (which I sync to them) are not being logged everytime but sporadically.

[jimp]

Maybe some browser add-on isn't actually removing your cookie when you logout? Or something similar.

When the browser actually logs out and back in, it gets logged. You appear to have some local problem and not a problem with the firewall.

[maverick_slo]

Well I did complete reset of browser and now it works correctly.

Thanks for suggestions!