System > Settings > Logging > Max log filesize (MB) is actually GB

[huamiao]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• [ X ] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [ X ] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

System > Settings > Logging > Max log filesize (MB) is actually GB

This bug is a copy of #7273 since it did not use a valid template. And I also have the same issue.

To Reproduce

Steps to reproduce the behavior:

1. Go to 'System > Settings > Logging'
2. Set a proper value for "Maximum file size (MB)", e.g: 1 (MB)
3. Check the log files under /var/log, Let's check firewall logs here under /var/log/filter/
4. The log file could be more larger than 1MB but won't rotate. The value 1 means 1GB but not 1MB here.

Expected behavior

The log files should rotate when they reach the max file size.

Describe alternatives you considered

Please change MB to GB in the description or threat the value as MB, not GB. I personally prefer MB.

Screenshots
Configuration field as the screenshot

Relevant log files

N/A

Additional context

N/A

Environment

OPNsense 24.1.6 (amd64).

[fichtner]

To be honest this looks fine:

core/src/opnsense/scripts/syslog/log_archive

Line 65 in be5ad0f

if (!empty($maxfilesize) && (filesize($items[0]) / 1024 / 1024) > $maxfilesize) {

https://www.php.net/manual/en/function.filesize.php

"Returns the size of the file in bytes"

What datapoints are you looking at on the file system? A log file can grow as much as it will given the amount stored and the log rotation is kicked in every hour which could skew your conclusion. It's actually the minimum size to start rotation but it cannot alter a file if it has grown bigger.

Cheers,
Franco

[huamiao]

I found the issue #7273 from this post [https://forum.opnsense.org/index.php?topic=38966.0]. And the post said the log won't be rotated after a day.
In my case, I'm looking at filter's log under /var/log/filter. As the screenshot, I set the max value to 10MB and the file grows to 40MB+ in 1 hour and won't rotate after 6 hours ( That's my last check and then I disable the logs). I'll try it again today.
I'm not familiar with php but the php manual said the filesize() result might be cached in some scenarios. Is that could be the reason?

[huamiao]

Update:

1. Set file limit to 1MB
   
2. Enabled firewall logs and the file size is 351KB at 22:44
   
3. Check the file at 22:47, file size is 1.3MB
   
4. Check the file at 23:37, file size is 15MB. And there is a latest link point to the log file which created at 23:01. This link should be created by the log_archive script.
   
5. Check the file at 23:48, file size is 18MB

As you see the oversized file was not archived. I'll keep watching tomorrow.

[huamiao]

Update 2:

log_archive works properly at the second day:

1. The new log file for the second day has been created
   
2. Wait for couple hours, the log files rotate as expected.
   

Then, I reset the log (Disable firewall logs, delete all filter log files and Enable firewall logs). And do the steps again and the issue of first day just come back.

1. Start log at 10:50, log file size is 39KB
2. Check files at 13:40, log file size is 40MB, no rotate files.

[fichtner]

IMO this could only mean it’s mismatching on the file to check. I’ll look at it next week.

[AdSchellevis]

The problem seems to be the "delete all logs" here, it needed at least two files to calculate the suffix, 73c3b88 should fix this.

[fichtner]

👍