Nginx Plugin :: Log Viewer

[ccesario]

Hello @fabian,
I upgrade two appliances to 18.7.9 and I could see that nginx has log viewr (Nice, thanks for it!)

But when I try access any logs, my Browser crash (in both appliances). I supose that is bacuse the size log file.
looking the logs I could see the following.

Code: [Select]

[14-Dec-2018 00:01:31 America/Sao_Paulo] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 1522266880 bytes) in /usr/local/opnsense/mvc/app/library/OPNsense/Nginx/AccessLogParser.php on line 42
[14-Dec-2018 00:02:20 America/Sao_Paulo] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 1522290512 bytes) in /usr/local/opnsense/mvc/app/library/OPNsense/Nginx/AccessLogParser.php on line 42
[14-Dec-2018 00:02:24 America/Sao_Paulo] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 1522308872 bytes) in /usr/local/opnsense/mvc/app/library/OPNsense/Nginx/AccessLogParser.php on line 42
[14-Dec-2018 00:02:42 America/Sao_Paulo] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 1522314600 bytes) in /usr/local/opnsense/mvc/app/library/OPNsense/Nginx/AccessLogParser.php on line 42
[14-Dec-2018 00:02:43 America/Sao_Paulo] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 1522314800 bytes) in /usr/local/opnsense/mvc/app/library/OPNsense/Nginx/AccessLogParser.php on line 42
[14-Dec-2018 00:05:48 America/Sao_Paulo] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 1522354280 bytes) in /usr/local/opnsense/mvc/app/library/OPNsense/Nginx/AccessLogParser.php on line 42
[14-Dec-2018 00:15:23 America/Sao_Paulo] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 1522830464 bytes) in /usr/local/opnsense/mvc/app/library/OPNsense/Nginx/AccessLogParser.php on line 42
[14-Dec-2018 08:19:09 America/Sao_Paulo] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 1536664032 bytes) in /usr/local/opnsense/mvc/app/library/OPNsense/Nginx/AccessLogParser.php on line 42
DO you got similar problem ?

Regards

Carlos

[franco]

Seems to read a huge log file all at once. PHP says no.


Cheers,
Franco

[ccesario]

Yes Franco, it seems.
Maybe a limiter with auto-refresh can solve it (like a tail -20 logfile )

Regaards

[fabian]

This would not help,  If you have around 400M  (just separate: 402_653_184) on server side, it will definitely also kill your browser even if I pass that through in smaller pieces. For such big log files I would not recommend to use them in a web interface. In your case I would recommend the ELK stack, which is better optimized for such problems (pagination is a problem here because the amount of entries is not fixed and new pages may come every second).

[ccesario]

Hi @fabian, yes, the log file is big, but Im running default nginx config, I did not touch in config.

[fabian]

nginx now has a log rotation which should prevent logs becoming that large. Maybe it will work tomorrow as it wasn't ever rotated yet

[ccesario]

Hi @fabian, you was rigth, the nginx rotate the logs.
But, even with log rotation, the interface crashes when try load the log file.

About the tail -f solution, I think that can be a good choice, even with a big file the browser/php does not crash.

Like this

https://github.com/pfsense/pfsense-packages/blob/903855b9b2d726f09594f6caccad8015b6063ca8/config/squid3/34/squid_monitor.php#L48-L66
https://github.com/pfsense/pfsense-packages/blob/903855b9b2d726f09594f6caccad8015b6063ca8/config/squid3/34/squid_monitor_data.php

[fabian]

for now, I have replaced the backend call by a line by line read, which may fix the problem.

https://github.com/opnsense/plugins/pull/1075

opnsense-patch -c plugins 537da9cbe58d5291c5963df8e72fda5e7f770eba

[ccesario]

Patch applyed, but the browser still crash (tested in several browsers) 

# opnsense-patch -c plugins 537da9cbe58d5291c5963df8e72fda5e7f770eba
....
done
All patches have been applied successfully.  Have a nice day.

[fabian]

ok but the backend works?

[ccesario]

Yes, I deleted the error log and re-created it with  (currently has 10 lines) and I can see by GUI log viewer

[fabian]

the patch only reduces some memory use of PHP but it sends the same data. Since I do not have such a big log, it will be probably very hard for me to reproduce.

Do you know if the crash happens while rendering (creating a long table) or already when reading the response?

[ccesario]

Well, I don't know tell when the error happen. indeed I did not investigate it.
I will take a time for this..... and if you want,I can provide one of my log files to you reproduce the problem.

[fabian]

A log file would be good, please take care that you do not violate any data protection laws - so at least replace the IPs by :: and 0.0.0.0.

[ccesario]

Hi Fabian,
Could you please provide me an email to snd the file?
Best regards