Problem with log viewer

DevAuto · Sep 18, 2007, 10:41 PM

Hi, I have searched the forums and have not found an answer to my issue, so if I missed it somehow, please point me in the right direction.

I am running the 1.2RC2 version and the problem I am having is when I view the logs, I only see between 25-300 or so entries, yet in the settings I have selected to display 2000 log entries. This problem only manifests itself in the firewall logs, all the other log tabs seem to behave okay. When I view the raw log entries, I see them all, so I know the logs are there. Is this a problem with the way logs are displayed in the viewer, or is it a problem in the way log entries are parsed for viewing? Also, am I the only one having this problem?

This may be part of the problem, I see the following filling up lots of space in my logs, and I am not sure what it means or why it is there, can anyone enlighten me?

Sep 18 18:36:15 pf:
Sep 18 18:36:15 pf:
Sep 18 18:36:15 pf: WARNING: Short packet. Try increasing the snap length
Sep 18 18:36:15 pf: Name=
Sep 18 18:36:15 pf: QuestionRecords:
Sep 18 18:36:15 pf: AddressRecCount=0
Sep 18 18:36:15 pf: AuthorityCount=0
Sep 18 18:36:15 pf: AnswerCount=0
Sep 18 18:36:15 pf: QueryCount=1
Sep 18 18:36:15 pf: Rcode=0
Sep 18 18:36:15 pf: NmFlags=0x11
Sep 18 18:36:15 pf: OpCode=0
Sep 18 18:36:15 pf: TrnID=0x812D
Sep 18 18:36:15 pf: >>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST

I was previously running m0n0wall, and never had this problem with viewing the logs, so I am not sure if the problem is resident in previous versions of pfSense or not.

Except for this one issue, I love pfSense, it is everything I loved about m0n0wall, with some additional features that I really like, GREAT JOB to the developers!

morbus · Sep 19, 2007, 3:39 PM

I have this problem too.

If it helps I am using 3com nics on a CARP system with the mtu on the wan reduced to 1412 for IPSEC RDP use

tacfit · Sep 19, 2007, 8:20 PM

Same issue here. Drives me wild.

cmb · Sep 20, 2007, 3:05 AM

I'm not sure if the count issue is related to that pflog snaplen problem, but I've opened a ticket on that particular issue. I haven't seen any log display counting issues in at least a year if not more.

tacfit: Are you seeing the short packet warning, or the wrong log count, or both, or?

tacfit · Sep 20, 2007, 6:35 AM

@cmb:

tacfit: Are you seeing the short packet warning, or the wrong log count, or both, or?

I haven't checked the system log, so I don't know about the short packet warning, I'm definetly seeing a wierd log count though. It jumps from 20 entries to maybe 100, no matter what value I set.

DevAuto · Sep 21, 2007, 2:09 AM

Thank you for opening the ticket, I guess I will just have to wait and see what comes back on it. I don't code well (okay, so I don't code at all), but I am willing to test if you need me to. Let me know if there is anything I can do. Again, thank you!

morbus · Oct 11, 2007, 1:10 PM

billm has committed a fix for this to the newer snapshots (and RC3)

2007-Oct-05 17:52:51 by billm:
Committed a potential fix (works for me), please test.

It works fine for me my logs are now displaying fine

Thanks

cmb · Oct 12, 2007, 3:31 AM

Thanks for the confirmation, morbus.

razor2000 · Oct 15, 2007, 3:48 AM

I'd like to add that upgrading to 1.2 RC-3 has fixed all the log viewer issues I was previously having. Six boxes fixed and counting…... :)