25.7 AND 25.1 nothing shown in firewall log (live view , Overview, and Plain View)?

[Wolfspyre]

I know, not 25.1 solely, but not really sure of the best place to raise this question.

Since upgrading to 25.7, the live view firewall logs no longer show anything on my systems.

I witnessed the problem on my standby firewall, but the HA sync page's advise of (paraphrased)
'the standby and primary are running different versions, upgrade to avoid weirdness' 

lead me to think that this was likely a symptom of having the pair split across versions.

however, that's not the case.

Things WORKING:
- all of the panes within `diagnostics` show data
- `/ui/firewall/alias_util/` shows aliases and counters as expected.
- `/ui/diagnostics/firewall/statistics#rules` shows all the rules alongside evaluations and counters
- `/ui/diagnostics/firewall/pf_top` shows sessions as expected
- `/ui/diagnostics/firewall/states` shows states as expected
- `/ui/diagnostics/firewall/statistics#info` shows all the expected counters as usual
- `ui/diagnostics/log/core/firewall` shows some stuff (mostly the update of fail2ban from maltrail)
- The statistics on matches in an interface's rulesets still work.
- PF is still doing its' thing.
- the lobby dashboard

the firewall pair is still working correctly afaict...
however....

under firewall/logfiles
( live view | overview | Plain view )
none of these show content.

All the panes in `/ui/fiagnostics/firewall/stats` show 'No Data Available'

The live view shows nothing.

Anyone have similar experiences?
Suggestions?
any diagnostic steps that would be useful or informative?

- I have validated that 'enable local logging' is checking in 'system/settings/logging'.
- I have disabled local logging and re-enabled it.
- I have reset the logfiles.

under `system:settings:logging` on the statistics pane, it seems like syslog's healthy.... I'm a bit confused.

[Wolfspyre]

img of log statistics pane under logging.

[newsense]

25.1 is where you need to be. Go back to System - Firmware and switch from Development to Community, then check for updates.

[franco]

Infamous "works for me" on latest opnsense-devel. Clearing browser cache would be my first suggestion.


Cheers,
Franco

[Wolfspyre]

I tried multiple browsers in anonymous mode before even considering posting here..

Any suggestions on what I might do/try to do to identify where the problem might be?

[franco]

Easy ICMP rule with logging with source of client. Start ping from client and watch live log?


Cheers,
Franco

[Wolfspyre]

Nada.
Nothing shows in the UI.
Where should I look systemically to step back?

IE: What does the 'live view' webui use as its' source?
how can I tap there to see if log events are present there?

[rt63s]

I have the same problem. Since updating to 25.1.3 no filterlog is being generated. Other logs are but not filterlog.

[Wolfspyre]

well.... at least it's not **JUST** me :)

[rt63s]

If you haven't already try a reboot of your router, I rebooted the router and now have the filterlog being generated to disk.

[keeka]

I recently installed 25.1.3 from the iso.
During bootup, I'm seeing blocks logged with descriptions that are associated with system and user-defined PASS rules.
e.g. 'let out anything from firewall host itself (force gw)' and a user rule (associated with a port forward) that passes udp/53 to the firewall 127.0.0.1. I have default block logging turned off.

Is this to be expected during start-up? These anomalous log entries do stop immediately the opnsense host is fully up and running. But I wondered how the description from a pass rule get associated with a block in the log.

[Wolfspyre]

Okay,

at this point, I'm really pretty stumped.

- I have rolled my standby firewall back to 25.1.5_5
- I have replaced all -devel packages with their "stable" counterparts

I am still unable to see any firewalling events in live view.
now, if my config broke something, that's .... okay, whatever... that's on me.

Nevertheless, The problem encountered **STILL** aught be logged, but I'm not seeing anything obvious.
Neither the dashboard's live view of firewall actions, nor the  live view display anything.

This **IS** somewhat troublesome, as I've been attempting to sort out some bad traffic, and the lack of ability to inspect this in the webui is, mildly problematic.


Could really use some pointers as to what to inspect or what might be contributing to the problem...


I'm sure it's my fault.... but I'm stumped as to how. ;)

 

[Wolfspyre]

I'd really appreciate some insight, as I'm kinda at a loss as to how to solve my own problem here.

what feeds the log plumbing here?

How can I walk back the cat, as it were?

What information would be helpful in further teasing apart the problem I've made for myself here? :)

[newsense]

Create a rule allowing ICMP to 9.9.9.9 and make it the first in the list. Have a machine in that (v)lan do a continous ping in 9.9.9.9.

Go to Live View and filter by address contains 9.9.9.9

Post a screenshot with the rule and with the live view.

[FredFresh]

Hello, Here is a similar situation: on live view I can see only a very limited amount of line.
If I ping 9.9.9.9 I see replies on the Windows computer terminal, but there is nothing on the liveview or plain view.

This happens both with a specific rule in place or not.

I don't know if it's just my error but, shouldn't the liveview show everything even if the single rules are not flagged to be logged? (blue circle with a "i" inside)