Firewall Live View

[atom]

Hello,

I'm on version 22.7.9 and just noticed a change in Live View. The filtered data is only displayed for about 2 minutes. After that they disappear again. This makes it very difficult to search for data because the display period is very short. Is it possible to set it back to the way it was before ?

Regards,
atom

[franco]

Did you disable auto-refresh?


Cheers,
Franco

[atom]

No, Auto refresh is enabled.

Regards,
atom

[franco]

I suppose auto-refresh will eventually show you new matching entries, because that is what it does.

If there are no matches in the set of changes fetched from the log it'll stop displaying anything naturally.


Cheers,
Franco

[atom]

I only get to see data that is no older than about 2 minutes. Then they disappear automatically, although the number of 25 entries has not yet been reached.
I mean that before it was so that the entries were visible until the maximum number of 25 has been exceeded ( or 50, 100 depending on what has been set ).

Regards,
Thomas

[atom]

I took two screenshots about 2 minutes apart.

[franco]

Hi Thomas,

I think you don't consider the fact that the log might add a lot of non-filtered entries and then naturally the results disappear in the bulk fetched by the GUI. You can make the fetched data bigger with the size drop down, but any limit will have a boundary where entries disappear.


Cheers,
Franco

[atom]

Hi Franco,

Has the behavior changed ?
I could previously filter the log for hours ( and see all entries ).

Regards,
atom

[franco]

There were a number of fixes when the system failed to filter correctly, around 22.7.6/7.

Perhaps the previous behaviour was more desirable but still a bit buggy in that regard. Turning off the auto-refresh should really help emulate the previous experience. I don't see much leeway in the middle.


Cheers,
Franco

[Do0m_X]

Hello,

I have the same problem. But for me, it does not remain 2 minutes but only a few seconds. As soon as I update manually (or automatically) the previous entries disappear. This makes log analysis impossible.

Regards,

[Fright]

@franco
Hi!
i think it may be at
https://github.com/opnsense/core/commit/67d22336fa7f4fef901473f580ce911864829e12
looks like table cleanup a bit oversimplified

what if we replace

Code Select Expand


                    // limit output, try to keep max X records on screen.
                    $("#grid-log > tbody > tr:gt("+max_rows+")").remove();

with

Code Select Expand


                    // limit output, try to keep max X records on screen.
                    $('#grid-log > tbody > tr:hidden').remove();
                    $("#grid-log > tbody > tr:gt("+max_rows+")").remove();

?
(first remove filtered-out rows and only then slice the table to the max_rows level)

[Fright]

@atom
can you test

Code Select Expand


opnsense-patch -a kulikov-a dd37ff3

please?

[atom]

Hi Fright,

great.
The filtering now works again over a longer period of time (as far as I can tell after a few minutes of testing).

Regards,
atom

[franco]

I'm entirely unsure if keeping stale results in the client side is the best course of action here. I can see the utility but it requires very infrequent occurrence of the issue to even observe it and new results will always flush the old ones correctly anyway.


Cheers,
Franco

[atom]

Hi Franco,

How it works now with the patch again helps me to find events that occur only rarely.
So I can filter it over hours without anything slipping through.

Regards,
atom