Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    What determines how many logs are shown?

    webGUI
    4
    15
    2758
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      Trel last edited by

      If I go to my system logs and firewall tab, I see

      "Last 36 firewall log entries.Max(50)"

      If I manually change the quantity to 200, I see

      "45 matched log entries.Max(200)"

      My question is, since 45 is under the 50 maximum, why is it truncating the list to X entries under the default max view?

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned last edited by

        Eeeh… considered the possibility that there are just NOT enough log entries to fill the max?

        1 Reply Last reply Reply Quote 0
        • T
          Trel last edited by

          @doktornotor:

          Eeeh… considered the possibility that there are just NOT enough log entries to fill the max?

          There are 45 entries, it shows 36.
          The max unless I say otherwise is 50.

          Why is it NOT showing those 9?

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned last edited by

            Sigh. Ever considered that the number of log entries usually grows with time?

            1 Reply Last reply Reply Quote 0
            • K
              kejianshi last edited by

              Filter active?

              My logs are full of noise - Wish I had your problem.

              1 Reply Last reply Reply Quote 0
              • T
                Trel last edited by

                @doktornotor:

                Sigh. Ever considered that the number of log entries usually grows with time?

                Please stop assuming I'm an idiot.  The number is shrinking, not growing.

                Note the times in the attachments.




                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned last edited by

                  36 -> 45 is shrinking? Other than that, perhaps reading this would help: Why can't I view view log files with cat/grep/etc? (clog)

                  Namely:

                  The log files created for use by pfSense with clog are a fixed size that holds a certain amount of data total, not log entries.

                  Sounds like you need bigger Log File Size.

                  1 Reply Last reply Reply Quote 0
                  • K
                    kejianshi last edited by

                    What do you have in:

                    Status: System logs: Settings

                    GUI Log Entries to Display
                    Hint: This is only the number of log entries displayed in the GUI. It does not affect how many entries are contained in the actual log files.

                    I have 200 - Because I LOVE clutter (-:

                    1 Reply Last reply Reply Quote 0
                    • T
                      Trel last edited by

                      @kejianshi:

                      What do you have in:

                      Status: System logs: Settings

                      GUI Log Entries to Display
                      Hint: This is only the number of log entries displayed in the GUI. It does not affect how many entries are contained in the actual log files.

                      I have 200 - Because I LOVE clutter (-:

                      I have it set to 50.  As you can see in the picture, when it's set to 50, it's showing 15.
                      When I manually put 500, it showed 80.  When I then removed the 500 filter, it showed 15.

                      1. I just changed it to 200, and it showed 26.
                      2. I manually typed in 200, and it showed 84.
                      3. I clicked the firewall tab (no postdata) and it showed 26 again.

                      1 Reply Last reply Reply Quote 0
                      • T
                        Trel last edited by

                        @doktornotor:

                        36 -> 45 is shrinking? Other than that, perhaps reading this would help: Why can't I view view log files with cat/grep/etc? (clog)

                        No, but 45 -> 36 is.
                        However, the data is all there, and typing a number in the filter shows it.

                        I included two pictures that clearly show the discrepancy is moving in the opposite direction (eg: the number is getting smaller, not larger).

                        And I should point out that my log file size is set to 2,000,000 bytes.  I highly doubt that 80 entries is going to fill even close to that amount of data if it's plain text.

                        Disk space currently used by log files: 16M. Remaining disk space for log files: 406G.

                        EDIT: fixed number

                        1 Reply Last reply Reply Quote 0
                        • K
                          kejianshi last edited by

                          Hmmm - Thats all I have on the subject.  No idea what is happening then.

                          1 Reply Last reply Reply Quote 0
                          • T
                            Trel last edited by

                            I think before I debug any further, I'm going to backup my config and do a completely fresh install this weekend.

                            1 Reply Last reply Reply Quote 0
                            • K
                              kejianshi last edited by

                              Thats a sane plan.

                              1 Reply Last reply Reply Quote 0
                              • P
                                phil.davis last edited by

                                @Trel - you may not be crazy - ignore those other guys hassling you in this thread.
                                My system has the same behavior, when I go to the Firewall Log it shows me maybe 39 of max 100 entries.

                                clog /var/log/filter.log | tail -n 100

                                I have a bunch of firewall log entries in there for "igmp" (as well as other "normal" UDP and/or TCP and/or ICMP).
                                The backend code that parses filter.log to extract the details does not have code to handle IGMP and it is skipping those entries. Thus after it parses some chunk of the end of the file, it may end up with less than the max entries setting, even though there are plenty of lines in filter.log

                                Bug report: https://redmine.pfsense.org/issues/4343
                                Pull request: https://github.com/pfsense/pfsense/pull/1456

                                That change fixes it for me.

                                See if it fixes it for you.

                                If not, then look at the end of /var/log/filter.log and see what other entries are there with other protocols. I suspect that the code does not handle protocol 112 (CARP) entries either. But I do not have a CARP setup to try and log.

                                As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kejianshi last edited by

                                  For the record - Never thought he was crazy.  Just couldn't locate the issue myself.

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post