config.xml empty all of a sudden

[jan_p]

@stephenw10 Looks like it's WireGuard.

I tried posting example of the changes, but I was not allowed to.
It contains applying default settings, installing earlysheelcmd(s) and de-installing and then installing ACL group WireGuard

Wireguard was locked down to only accept connections from 2 specific IP's. I don't know if my phone ( one of the ip's ) could have triggered these. A software update maybe?

[stephenw10]

Ah, that can happen at boot with Wireguard so I imagine it was repeatedly rebooting? Though it's a lot inside 1 min....

[jan_p]

@stephenw10
hmmm.
In system.log, I see 2 boots at 04:36:33. As soon as the first boot completed, it booted again.
I don't know why it booted though. I have a UPS providing power.
I do see the same pattern on the Jan 13th.
Maybe the UPS, was testing the battery, and briefly interrupted power?
Don't know that I have a method of verifying that though.

I can understand the config file is lost, if WireGuard updates the config file, and then a second boot occur, right in between the old config is moved aside, but before the new file is written.

Maybe something to discuss with dev's. If the process can be optimized somehow, so the config file is not actually deleted, but the firmware keep a pointer to the most recent file instead.
Or maybe split the config file, separating out 3rd party add-on's, as well as more dynamic content, like DHCP address updates into separate files. Ensuring that the core configuration is never lost?

[stephenw10]

Nothing shown in the log before it starts booting again?

[jan_p]

@stephenw10 Not sure I follow, but in system.log there's nothing that stands out to me, other than boot messages I would expect. After first boot completes, straight in to booting again.

Jan 22 04:36:33 pfSense kernel: All buffers synced.
Jan 22 04:36:33 pfSense kernel: Uptime: 16m7s
Jan 22 04:36:33 pfSense kernel: ---<<BOOT>>---
Jan 22 04:36:33 pfSense kernel: Copyright (c) 1992-2023 The FreeBSD Project.

Uptime, confuses me though. that doesn't map to what I see in system.log.
There are only two instances of the copyright message for example. When it boots the first time at 04:36:33 and the second time, within the same minute.
Previous boot prior to this on the January 13th as far as I can tell.

[Gertjan]

@jan_p said in config.xml empty all of a sudden:

Jan 22 04:36:33 pfSense kernel: All buffers synced.
Jan 22 04:36:33 pfSense kernel: Uptime: 16m7s
Jan 22 04:36:33 pfSense kernel: ---<<BOOT>>---
Jan 22 04:36:33 pfSense kernel: Copyright (c) 1992-2023 The FreeBSD Project.

That's you (an admin) rebooting the system.

Visit Youytube, the Negate channel and look at the file system checker video.
If the file system is dirty, it can become read only what would explain "no more writes" == no more config.xml.

[stephenw10]

Well not necessarily admin rebooting but something rebooted deliberately. Those last logs are pfSense correctly shutting down. I.e. it didn't spontaneously reboot.

So there should be something logged when it starts rebooting that might show why.

[Gertjan]

@stephenw10 said in config.xml empty all of a sudden:

but something rebooted deliberately

Don't wake up the "pfSense auto re boot" as, afaik, it can't / it doesn't.
( right ? you tell me ! )

A reboot is a mouse click in the GUI or someone using menu option 5 or menu option 8 and typing the reboot command.

So something is someone - a person.

[stephenw10]

It reboots at upgrade for example. Or you could add a cron job to reboot. A UPS battery low signal could shut it down.

Either way something triggered it. It didn't see a hard reset.

[jan_p]

@stephenw10 I did shut it down twice while troubleshooting, to make it restart. This was while the network was down, and I was trying to figure out why, before I connected a monitor directly to it.
I'll go through the logs again, and see if I can find any clues to why it went down in the first place ( and what caused the config file to be left empty ).