What determines how many logs are shown?

Trel

If I go to my system logs and firewall tab, I see

"Last 36 firewall log entries.Max(50)"

If I manually change the quantity to 200, I see

"45 matched log entries.Max(200)"

My question is, since 45 is under the 50 maximum, why is it truncating the list to X entries under the default max view?

doktornotor

Eeeh… considered the possibility that there are just NOT enough log entries to fill the max?

Trel

@doktornotor:

Eeeh… considered the possibility that there are just NOT enough log entries to fill the max?

There are 45 entries, it shows 36.
The max unless I say otherwise is 50.

Why is it NOT showing those 9?

doktornotor

Sigh. Ever considered that the number of log entries usually grows with time?

kejianshi

Filter active?

My logs are full of noise - Wish I had your problem.

Trel

@doktornotor:

Sigh. Ever considered that the number of log entries usually grows with time?

Please stop assuming I'm an idiot. The number is shrinking, not growing.

Note the times in the attachments.

pflog_01.jpg_thumb

pflog_02.jpg_thumb

doktornotor

36 -> 45 is shrinking? Other than that, perhaps reading this would help: Why can't I view view log files with cat/grep/etc? (clog)

Namely:

The log files created for use by pfSense with clog are a fixed size that holds a certain amount of data total, not log entries.

Sounds like you need bigger Log File Size.

kejianshi

What do you have in:

Status: System logs: Settings

GUI Log Entries to Display
Hint: This is only the number of log entries displayed in the GUI. It does not affect how many entries are contained in the actual log files.

I have 200 - Because I LOVE clutter (-:

Trel

@kejianshi:

What do you have in:

Status: System logs: Settings

GUI Log Entries to Display
Hint: This is only the number of log entries displayed in the GUI. It does not affect how many entries are contained in the actual log files.

I have 200 - Because I LOVE clutter (-:

I have it set to 50. As you can see in the picture, when it's set to 50, it's showing 15.
When I manually put 500, it showed 80. When I then removed the 500 filter, it showed 15.

1. I just changed it to 200, and it showed 26.
2. I manually typed in 200, and it showed 84.
3. I clicked the firewall tab (no postdata) and it showed 26 again.

Trel

@doktornotor:

36 -> 45 is shrinking? Other than that, perhaps reading this would help: Why can't I view view log files with cat/grep/etc? (clog)

No, but 45 -> 36 is.
However, the data is all there, and typing a number in the filter shows it.

I included two pictures that clearly show the discrepancy is moving in the opposite direction (eg: the number is getting smaller, not larger).

And I should point out that my log file size is set to 2,000,000 bytes. I highly doubt that 80 entries is going to fill even close to that amount of data if it's plain text.

Disk space currently used by log files: 16M. Remaining disk space for log files: 406G.

EDIT: fixed number

kejianshi

Hmmm - Thats all I have on the subject. No idea what is happening then.

Trel

I think before I debug any further, I'm going to backup my config and do a completely fresh install this weekend.

kejianshi

Thats a sane plan.

phil.davis

@Trel - you may not be crazy - ignore those other guys hassling you in this thread.
My system has the same behavior, when I go to the Firewall Log it shows me maybe 39 of max 100 entries.

clog /var/log/filter.log | tail -n 100

I have a bunch of firewall log entries in there for "igmp" (as well as other "normal" UDP and/or TCP and/or ICMP).
The backend code that parses filter.log to extract the details does not have code to handle IGMP and it is skipping those entries. Thus after it parses some chunk of the end of the file, it may end up with less than the max entries setting, even though there are plenty of lines in filter.log

Bug report: https://redmine.pfsense.org/issues/4343
Pull request: https://github.com/pfsense/pfsense/pull/1456

That change fixes it for me.

See if it fixes it for you.

If not, then look at the end of /var/log/filter.log and see what other entries are there with other protocols. I suspect that the code does not handle protocol 112 (CARP) entries either. But I do not have a CARP setup to try and log.

kejianshi

For the record - Never thought he was crazy. Just couldn't locate the issue myself.