Problem with log viewer

  • Hi, I have searched the forums and have not found an answer to my issue, so if I missed it somehow, please point me in the right direction.

    I am running the 1.2RC2 version and the problem I am having is when I view the logs, I only see between 25-300 or so entries, yet in the settings I have selected to display 2000 log entries. This problem only manifests itself in the firewall logs, all the other log tabs seem to behave okay. When I view the raw log entries, I see them all, so I know the logs are there. Is this a problem with the way logs are displayed in the viewer, or is it a problem in the way log entries are parsed for viewing? Also, am I the only one having this problem?

    This may be part of the problem, I see the following filling up lots of space in my logs, and I am not sure what it means or why it is there, can anyone enlighten me?

    Sep 18 18:36:15 pf:
    Sep 18 18:36:15 pf:
    Sep 18 18:36:15 pf: WARNING: Short packet. Try increasing the snap length
    Sep 18 18:36:15 pf: Name=
    Sep 18 18:36:15 pf: QuestionRecords:
    Sep 18 18:36:15 pf: AddressRecCount=0
    Sep 18 18:36:15 pf: AuthorityCount=0
    Sep 18 18:36:15 pf: AnswerCount=0
    Sep 18 18:36:15 pf: QueryCount=1
    Sep 18 18:36:15 pf: Rcode=0
    Sep 18 18:36:15 pf: NmFlags=0x11
    Sep 18 18:36:15 pf: OpCode=0
    Sep 18 18:36:15 pf: TrnID=0x812D
    Sep 18 18:36:15 pf: >>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST

    I was previously running m0n0wall, and never had this problem with viewing the logs, so I am not sure if the problem is resident in previous versions of pfSense or not.

    Except for this one issue, I love pfSense, it is everything I loved about m0n0wall, with some additional features that I really like, GREAT JOB to the developers!

  • I have this problem too.

    If it helps I am using 3com nics on a CARP system with the mtu on the wan reduced to 1412 for IPSEC RDP use

  • Same issue here. Drives me wild.

  • I'm not sure if the count issue is related to that pflog snaplen problem, but I've opened a ticket on that particular issue. I haven't seen any log display counting issues in at least a year if not more.

    tacfit: Are you seeing the short packet warning, or the wrong log count, or both, or?

  • @cmb:

    tacfit: Are you seeing the short packet warning, or the wrong log count, or both, or?

    I haven't checked the system log, so I don't know about the short packet warning, I'm definetly seeing a wierd log count though. It jumps from 20 entries to maybe 100, no matter what value I set.

  • Thank you for opening the ticket, I guess I will just have to wait and see what comes back on it. I don't code well (okay, so I don't code at all), but I am willing to test if you need me to. Let me know if there is anything I can do. Again, thank you!

  • billm has committed a fix for this to the newer snapshots (and RC3)

    2007-Oct-05 17:52:51 by billm:
    Committed a potential fix (works for me), please test.

    It works fine for me my logs are now displaying fine


  • Thanks for the confirmation, morbus.

  • I'd like to add that upgrading to 1.2 RC-3 has fixed all the log viewer issues I was previously having.  Six boxes fixed and counting…... :)

Log in to reply