OPNsense Forum

Archive => 22.7 Legacy Series => Topic started by: atom on December 06, 2022, 09:10:47 AM

Title: Firewall Live View
Post by: atom on December 06, 2022, 09:10:47 AM
Hello,

I'm on version 22.7.9 and just noticed a change in Live View. The filtered data is only displayed for about 2 minutes. After that they disappear again. This makes it very difficult to search for data because the display period is very short. Is it possible to set it back to the way it was before ?

Regards,
atom
Title: Re: Firewall Live View
Post by: franco on December 06, 2022, 09:29:51 AM
Did you disable auto-refresh?


Cheers,
Franco
Title: Re: Firewall Live View
Post by: atom on December 06, 2022, 09:36:01 AM
No, Auto refresh is enabled.

Regards,
atom
Title: Re: Firewall Live View
Post by: franco on December 06, 2022, 09:54:14 AM
I suppose auto-refresh will eventually show you new matching entries, because that is what it does.

If there are no matches in the set of changes fetched from the log it'll stop displaying anything naturally.


Cheers,
Franco
Title: Re: Firewall Live View
Post by: atom on December 06, 2022, 10:04:25 AM
I only get to see data that is no older than about 2 minutes. Then they disappear automatically, although the number of 25 entries has not yet been reached.
I mean that before it was so that the entries were visible until the maximum number of 25 has been exceeded ( or 50, 100 depending on what has been set ).

Regards,
Thomas
Title: Re: Firewall Live View
Post by: atom on December 06, 2022, 10:15:09 AM
I took two screenshots about 2 minutes apart.

Title: Re: Firewall Live View
Post by: franco on December 06, 2022, 10:18:12 AM
Hi Thomas,

I think you don't consider the fact that the log might add a lot of non-filtered entries and then naturally the results disappear in the bulk fetched by the GUI. You can make the fetched data bigger with the size drop down, but any limit will have a boundary where entries disappear.


Cheers,
Franco
Title: Re: Firewall Live View
Post by: atom on December 06, 2022, 10:46:56 AM
Hi Franco,

Has the behavior changed ?
I could previously filter the log for hours ( and see all entries ).

Regards,
atom
Title: Re: Firewall Live View
Post by: franco on December 06, 2022, 10:54:15 AM
There were a number of fixes when the system failed to filter correctly, around 22.7.6/7.

Perhaps the previous behaviour was more desirable but still a bit buggy in that regard. Turning off the auto-refresh should really help emulate the previous experience. I don't see much leeway in the middle.


Cheers,
Franco
Title: Re: Firewall Live View
Post by: Do0m_X on December 06, 2022, 11:26:49 AM
Hello,

I have the same problem. But for me, it does not remain 2 minutes but only a few seconds. As soon as I update manually (or automatically) the previous entries disappear. This makes log analysis impossible.

Regards,
Title: Re: Firewall Live View
Post by: Fright on December 06, 2022, 11:31:33 AM
@franco
Hi!
i think it may be at
https://github.com/opnsense/core/commit/67d22336fa7f4fef901473f580ce911864829e12
looks like table cleanup a bit oversimplified

what if we replace

                    // limit output, try to keep max X records on screen.
                    $("#grid-log > tbody > tr:gt("+max_rows+")").remove();

with

                    // limit output, try to keep max X records on screen.
                    $('#grid-log > tbody > tr:hidden').remove();
                    $("#grid-log > tbody > tr:gt("+max_rows+")").remove();

?
(first remove filtered-out rows and only then slice the table to the max_rows level)
Title: Re: Firewall Live View
Post by: Fright on December 06, 2022, 11:41:03 AM
@atom
can you test

opnsense-patch -a kulikov-a dd37ff3

please?
Title: Re: Firewall Live View
Post by: atom on December 06, 2022, 11:53:17 AM
Hi Fright,

great.
The filtering now works again over a longer period of time (as far as I can tell after a few minutes of testing).

Regards,
atom
Title: Re: Firewall Live View
Post by: franco on December 06, 2022, 12:57:27 PM
I'm entirely unsure if keeping stale results in the client side is the best course of action here. I can see the utility but it requires very infrequent occurrence of the issue to even observe it and new results will always flush the old ones correctly anyway.


Cheers,
Franco
Title: Re: Firewall Live View
Post by: atom on December 06, 2022, 01:14:44 PM
Hi Franco,

How it works now with the patch again helps me to find events that occur only rarely.
So I can filter it over hours without anything slipping through.

Regards,
atom
Title: Re: Firewall Live View
Post by: franco on December 06, 2022, 01:20:21 PM
Under the assumption it only occurs rarely, right. And knowing that you can keep the GUI running overnight to actually catch it. ;)

I suppose there is no historic approach to the live log, something the flat file (raw log) is providing, but not very elegantly.

FWIW, I only fear we reintroduce fixed bugs by fixing something that now isn't really broken from a technical standpoint. But not my call anyway. PRs help.


Cheers,
Franco
Title: Re: Firewall Live View
Post by: Fright on December 06, 2022, 01:35:50 PM
@franco
I'm not sure I understood you correctly.
it is the current behavior that leaves stale results (hidden rows), potentially cutting off the good ones. in fact, the appearance of normal operation was provided by an overestimated value of the displayed records (in fact, it is now always at least 1000)
due to https://github.com/opnsense/core/blob/a4b5a815c1374840552da2b2c974e2b717bf5a9d/src/opnsense/mvc/app/views/OPNsense/Diagnostics/fw_log.volt#L231

or i missed some?

pr: https://github.com/opnsense/core/pull/6177
Title: Re: Firewall Live View
Post by: franco on December 06, 2022, 01:54:58 PM
Not my call and I don't have interest in going back and fixing the live log in a similar fashion after 22.7.6/22.7.7 complaints. Either the live log is missing a clear description or the implementation doesn't really do what it's supposed to do.

Patching it again and again is certainly a bad sign.


Cheers,
Franco
Title: Re: Firewall Live View
Post by: Fright on December 06, 2022, 02:05:12 PM
looks like i really missed something in the history of the question  :-[
sorry then
Title: Re: Firewall Live View
Post by: atom on December 06, 2022, 03:07:09 PM
Hi Franco,

Sometimes I get errors sent from applications running at some point and I only know the port and address.
So far I have been able to use the Life View to filter the data without having to look at the screen all the time.
If the data was only visible for a few seconds, then I would have to look at the log all the time and couldn't do anything else.

Regards,
atom