Project

General

Profile

Actions
Copy link

Bug #16376

closed

Some remote syslog messages are duplicated when "System Events" option is enabled

Added by Christopher Cope 6 months ago. Updated 16 days ago.

Status:
Resolved
Priority:
Normal
Assignee:
Marcos M
Category:
System Logs
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
25.11.1
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

Tested on

25.07.1-RELEASE (amd64)
built on Wed Aug 13 1:59:00 EDT 2025
FreeBSD 15.0-CURRENT

With Status > System Logs > Settings set to send logs to a remote server it seems "System Events" also contains the same data as some of the other options.

Simply enabling "System Events" results in VPN Events, Netgate Nexus Events, and possibly others being sent. If "System Events" is enabled alongside the other options 2 copies of the same data is being sent.

Actions
Copy link
 #1

Updated by Craig Coonrad 6 months ago

  • Status changed from New to Confirmed

Confirmed

25.07.1-RELEASE (amd64)
built on Fri Aug 15 11:42:00 PDT 2025
FreeBSD 15.0-CURRENT

Example:

Aug 17 18:13:36 pfha00 pfnet-controller[96013]: WARNING aeadtun: error reading from controltun0: EOF
Aug 17 18:13:36 pfha00 pfnet-controller[96013]: WARNING aeadtun: error reading from controltun0: EOF
Aug 17 18:13:36 pfha00 pfnet-controller[96013]: INFO Quitting main
Aug 17 18:13:36 pfha00 pfnet-controller[96013]: INFO Quitting main
Aug 17 18:13:36 pfha00 pfnet-controller[96013]: INFO Done shutting down main
Aug 17 18:13:36 pfha00 pfnet-controller[96013]: INFO Done shutting down main
Actions
Copy link
 #2

Updated by John Pitton about 1 month ago

Craig Coonrad wrote in #note-1:

Confirmed
[...]

Example:

[...]

Still waiting on this fix. It really really sucks having either duplicate entries or having to enable Everything to a remote syslog server. Can I please get this addressed soon? Thanks!

Actions
Copy link
 #3

Updated by Marcos M 29 days ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100
Actions
Copy link
 #4

Updated by Marcos M 29 days ago

  • Assignee set to Marcos M
  • Target version set to 2.9.0
  • Plus Target Version set to 26.03
Actions
Copy link
 #5

Updated by Craig Coonrad 29 days ago

  • Status changed from Feedback to Resolved

Tested pfSense build 26.03.a.20260106.2058.
No longer seeing duplicate messages for ntpd, openvpn or pfnet-controller.

Actions
Copy link
 #6

Updated by Marcos M 22 days ago

  • Plus Target Version changed from 26.03 to 25.11.1
Actions
Copy link
 #7

Updated by Jim Pingle 16 days ago

  • Subject changed from With "System Events" enabled certain logs are duplicated on remote syslog to Some remote syslog messages are duplicated when "System Events" option is enabled
Actions
Copy link

Also available in: Atom PDF