Hello,
I'm on version 22.7.9 and just noticed a change in Live View. The filtered data is only displayed for about 2 minutes. After that they disappear again. This makes it very difficult to search for data because the display period is very short. Is it possible to set it back to the way it was before ?
Regards,
atom
Did you disable auto-refresh?
Cheers,
Franco
No, Auto refresh is enabled.
Regards,
atom
I suppose auto-refresh will eventually show you new matching entries, because that is what it does.
If there are no matches in the set of changes fetched from the log it'll stop displaying anything naturally.
Cheers,
Franco
I only get to see data that is no older than about 2 minutes. Then they disappear automatically, although the number of 25 entries has not yet been reached.
I mean that before it was so that the entries were visible until the maximum number of 25 has been exceeded ( or 50, 100 depending on what has been set ).
Regards,
Thomas
I took two screenshots about 2 minutes apart.
Hi Thomas,
I think you don't consider the fact that the log might add a lot of non-filtered entries and then naturally the results disappear in the bulk fetched by the GUI. You can make the fetched data bigger with the size drop down, but any limit will have a boundary where entries disappear.
Cheers,
Franco
Hi Franco,
Has the behavior changed ?
I could previously filter the log for hours ( and see all entries ).
Regards,
atom
There were a number of fixes when the system failed to filter correctly, around 22.7.6/7.
Perhaps the previous behaviour was more desirable but still a bit buggy in that regard. Turning off the auto-refresh should really help emulate the previous experience. I don't see much leeway in the middle.
Cheers,
Franco
Hello,
I have the same problem. But for me, it does not remain 2 minutes but only a few seconds. As soon as I update manually (or automatically) the previous entries disappear. This makes log analysis impossible.
Regards,
@franco
Hi!
i think it may be at
https://github.com/opnsense/core/commit/67d22336fa7f4fef901473f580ce911864829e12
looks like table cleanup a bit oversimplified
what if we replace
// limit output, try to keep max X records on screen.
$("#grid-log > tbody > tr:gt("+max_rows+")").remove();
with
// limit output, try to keep max X records on screen.
$('#grid-log > tbody > tr:hidden').remove();
$("#grid-log > tbody > tr:gt("+max_rows+")").remove();
?
(first remove filtered-out rows and only then slice the table to the max_rows level)
@atom
can you test
opnsense-patch -a kulikov-a dd37ff3
please?
Hi Fright,
great.
The filtering now works again over a longer period of time (as far as I can tell after a few minutes of testing).
Regards,
atom
I'm entirely unsure if keeping stale results in the client side is the best course of action here. I can see the utility but it requires very infrequent occurrence of the issue to even observe it and new results will always flush the old ones correctly anyway.
Cheers,
Franco
Hi Franco,
How it works now with the patch again helps me to find events that occur only rarely.
So I can filter it over hours without anything slipping through.
Regards,
atom
Under the assumption it only occurs rarely, right. And knowing that you can keep the GUI running overnight to actually catch it. ;)
I suppose there is no historic approach to the live log, something the flat file (raw log) is providing, but not very elegantly.
FWIW, I only fear we reintroduce fixed bugs by fixing something that now isn't really broken from a technical standpoint. But not my call anyway. PRs help.
Cheers,
Franco
@franco
I'm not sure I understood you correctly.
it is the current behavior that leaves stale results (hidden rows), potentially cutting off the good ones. in fact, the appearance of normal operation was provided by an overestimated value of the displayed records (in fact, it is now always at least 1000)
due to https://github.com/opnsense/core/blob/a4b5a815c1374840552da2b2c974e2b717bf5a9d/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt#L231
or i missed some?
pr: https://github.com/opnsense/core/pull/6177
Not my call and I don't have interest in going back and fixing the live log in a similar fashion after 22.7.6/22.7.7 complaints. Either the live log is missing a clear description or the implementation doesn't really do what it's supposed to do.
Patching it again and again is certainly a bad sign.
Cheers,
Franco
looks like i really missed something in the history of the question :-[
sorry then
Hi Franco,
Sometimes I get errors sent from applications running at some point and I only know the port and address.
So far I have been able to use the Life View to filter the data without having to look at the screen all the time.
If the data was only visible for a few seconds, then I would have to look at the log all the time and couldn't do anything else.
Regards,
atom