Bug #10574
closed
nginx flooding syslog, but "Web Server Log" disabled
0%
Description
Hi,
I have the "Web Server Log" disabled ("If this is checked, errors from the web server process for the GUI or Captive Portal will appear in the main system log."). But I'm still seeing a lot of entries in the system log from nginx, really every access it seems like. I just checked my remote log server (which is easier to filter on), and there are 2400 entries in the last 2 hours alone.
I don't mind modifying files locally if needed to try to help debug, but please let me know if you have any pointers / suggestions.
Thanks!
Updated by Jim Pingle about 5 years ago
- Category set to Logging
- Status changed from New to Not a Bug
The checkbox controls errors, not the access log. And the access logging is only sent to remote syslog servers, not local. There is no option to disable all nginx logging.
If you'd prefer to reframe this as a feature request, we may be able to accommodate that eventually, but it's not a bug.
Updated by Russell Morris about 5 years ago
Hi,
Ahh, OK - that makes sense. I wondered based on the wording. Thanks for clarifying!
Yes, it would be great to make this an option - avoid sending all that over the link (remote logging). Let me try to change this to a Feature Request (vs. a bug, as you say). But also, to try it out, I can see that if I have it right, the file I need to change is /var/etc/syslog.d/pfSense.conf, correct? It's auto generated, but I could edit it, kill and restart the needed process (which I think is /usr/sbin/syslogd -O rfc5424 -s -c -c -l /var/dhcpd/var/run/log -P /var/run/syslog.pid -f /etc/syslog.conf) => service syslogd restart doesn't seem to do it quite right, but I can manually kill and start it, NP.
Thanks!
Updated by Russell Morris about 5 years ago
Hmmm ... I don't seem to be able to change this from a Bug to a Feature Request - is that just me, or do I need to enter a new item?
Thanks!
Updated by Jim Pingle about 5 years ago
It would be better to make a fresh one since fixing this one would involve editing/changing all of the info to match the new request.
Updated by Russell Morris about 5 years ago
Sure, will do - NP! Let me created it, add a link here (OK?), then close this "bug" out.
Updated by Jim Pingle about 5 years ago
It's currently in a closed state so no worries about closing it out. You can certainly drop a link here to the new one once it's in.
Updated by Russell Morris about 5 years ago
OK, perfect - thanks! New feature created, here: https://redmine.pfsense.org/issues/10581.
And do you know, is there a way to temporarily work around this (change the syslog.conf file manually perhaps, then manually kill and start the syslogd service)?
Thanks again, appreciate the help!
Updated by Jim Pingle about 5 years ago
Probably not terribly difficult but not trivial, you'd have to setup the right directives to exclude things from the nginx process and you'd have to do that in the code which generates the syslog config, since it would get rewritten any time the service is restarted.
Not something we can get into here, but if you post on the forum someone can likely help you out there.
Updated by Russell Morris about 5 years ago
No problem, that makes sense. Thanks!