Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    GUI is only showing last 2000 log entries. Where can I see the rest?

    Scheduled Pinned Locked Moved General pfSense Questions
    11 Posts 5 Posters 1.1k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N Offline
      nfern
      last edited by

      Hi,
      I'm using netgatge xg7100 appliance with version 2.4.5
      I am trying to search logs, but i can oly see 2000 log entries on the system log page of the gui. where can i view the previous logs from the last couple of days?
      Thanks
      NF

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ Offline
        johnpoz LAYER 8 Global Moderator @nfern
        last edited by

        On your syslog server :) you were sending them there right..

        Before 2.5 logs were circular.. So they are gone unless you were sending them elsewhere.

        with 2.4.5 you can use clog to look at the file directly to see if older stuff is in there.. But again they are circular and old stuff will get overwritten..

        https://docs.netgate.com/pfsense/en/latest/releases/2-5-0.html#logging

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG Offline
          Gertjan @johnpoz
          last edited by

          Or go to to /var/log

          The most important logs are compacted to 'bz2' (log rotated) so weeks of info is still available.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ Offline
            johnpoz LAYER 8 Global Moderator @Gertjan
            last edited by johnpoz

            @gertjan said in GUI is only showing last 2000 log entries. Where can I see the rest?:

            'bz2' (log rotated) so weeks of info is still available.

            In 2.4.5?

            That is true on 2.5

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            GertjanG 1 Reply Last reply Reply Quote 0
            • GertjanG Offline
              Gertjan @johnpoz
              last edited by Gertjan

              Hummm.
              Now I understand why you were talking about 2.4.5 ....
              And I remember why I installed many years ago a local syslog server ;)

              (edit : I zapped to read the actual question .... )

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              1 Reply Last reply Reply Quote 0
              • N Offline
                NZ
                last edited by NZ

                FYI if you're searching Firewall logs.

                There is also a hard limit on the filter log parser to only 10K latest entries.
                So don't expect to see days of log data if your logs fill up quickly.
                https://redmine.pfsense.org/issues/11666

                If you want to see more data within the GUI.
                First set the Log Compression to "none"
                Set Log Retention Count to a high number (eg 99) (make sure you have a few GBs of HD for logging).

                Then you can view the rotation files directly in the Diagnostic\Edit File section.
                Just browse to "/var/log"

                1 Reply Last reply Reply Quote 0
                • bingo600B Offline
                  bingo600
                  last edited by

                  I would love for an extra logging option.
                  Right now we have logging on/off.

                  I would love to have
                  Gui logging on/off
                  Syslog logging on/off

                  I find that i sometimes do a "No logging rule" in order not to get the Gui logging totally cluttered by a crazy client.
                  But then i also loose the entry in the syslog , where i would like to have it.

                  Maybe i just have "sore eyes" , but it would be a neat feature.

                  /Bigo

                  If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                  pfSense+ 23.05.1 (ZFS)

                  QOTOM-Q355G4 Quad Lan.
                  CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                  LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ Offline
                    johnpoz LAYER 8 Global Moderator @bingo600
                    last edited by

                    If you don't want to see entry that are flooding your gui log, you can filter it. The ! can be used in filter to exclude something from the listing.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    bingo600B GertjanG 2 Replies Last reply Reply Quote 1
                    • bingo600B Offline
                      bingo600 @johnpoz
                      last edited by

                      @johnpoz

                      Thanx JP , will try that

                      But the feature would still be neat 😊

                      I do understand that they somehow might have to add a "Gui show/noshow" field in the logline , and that automation guyzz would hate me for that ... But .... Neat

                      /Bingo

                      If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                      pfSense+ 23.05.1 (ZFS)

                      QOTOM-Q355G4 Quad Lan.
                      CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                      LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ Offline
                        johnpoz LAYER 8 Global Moderator @bingo600
                        last edited by

                        While a more robust filtering system could be a nice addition.. Say for example an easy way to maintain a filter with multiple entries be it show only or exclude this list, etc. Or have sets of filters, that you can load or unload..

                        Toggling such action on the rules themselves - hmm.. I would think that would overly complicate the whole logging aspect.

                        But a filter you could load or unload to display specifics that are in the log shouldn't be all that hard to do.. Keep in mind that is coming from someone that doesn't actually code.. So I could be over looking something that makes that actually very difficult to accomplish ;)

                        Prob best option is just just send logs to your syslog - and use that to parse the data how you want.. And use that system to look at the logs vs the gui interface in pfsense. You can get pretty granular with such systems on what is shown or not shown, etc.

                        But if its just some temp over zealous bot hitting your wan and spamming your logs during a time frame your looking for something else in the logs - the ! filter of excluding something from the gui can help..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • GertjanG Offline
                          Gertjan @johnpoz
                          last edited by

                          @johnpoz said in GUI is only showing last 2000 log entries. Where can I see the rest?:

                          The ! can be used

                          Cooool !

                          A simple

                          !::
                          

                          works for me : now I see only portal traffic šŸ‘

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.