pfSense

I cannot see anything wrong in code regarding specifics to dhcp!

Can you please show the output of ls /var/log
and also /var/etc/syslog.conf or /etc/syslog.conf

$ ls /var/log
apinger.log
dhcpd.log
dmesg.boot
filter.log
ipsec.log
l2tp.log
lastlog
lighttpd.error.log
lighttpd.log
ntpd.log
openvpn.log
portalauth.log
ppp.log
pppoe.log
pptp.log
relayd.log
slbd.log
system.log
userlog
vpn.log

/var/etc/syslog.conf
ntpd
.* %/var/log/ntpd.log
!ppp
.* %/var/log/ppp.log
!pptp
.* %/var/log/pptp.log
!pppoe
.* %/var/log/pppoe.log
!l2tp
.* %/var/log/l2tp.log
!racoon
.* %/var/log/ipsec.log
!openvpn
.* %/var/log/openvpn.log
!apinger
.* %/var/log/apinger.log
!relayd
.* %/var/log/relayd.log
!-ntpd,racoon,openvpn
local0. %/var/log/filter.log
local3.* %/var/log/vpn.log
local4.* %/var/log/portalauth.log
local7.* %/var/log/dhcpd.log
.notice;kern.debug;lpr.info;mail.crit; %/var/log/system.log
news.err;local0.none;local3.none;local4.none; %/var/log/system.log
local7.none %/var/log/system.log
security. %/var/log/system.log
auth.info;authpriv.info;daemon.info %/var/log/system.log
auth.info;authpriv.info |exec /usr/local/sbin/sshlockout_pf
*.emerg *

/etc/syslog.conf
ntpd
.* %/var/log/ntpd.log
!ppp
.* %/var/log/ppp.log
!pptp
.* %/var/log/pptp.log
!pppoe
.* %/var/log/pppoe.log
!l2tp
.* %/var/log/l2tp.log
!racoon
.* %/var/log/ipsec.log
!openvpn
.* %/var/log/openvpn.log
!apinger
.* %/var/log/apinger.log
!relayd
.* %/var/log/relayd.log
!-ntpd,racoon,openvpn
local0. %/var/log/filter.log
local3.* %/var/log/vpn.log
local4.* %/var/log/portalauth.log
local7.* %/var/log/dhcpd.log
.notice;kern.debug;lpr.info;mail.crit; %/var/log/system.log
news.err;local0.none;local3.none;local4.none; %/var/log/system.log
local7.none %/var/log/system.log
security. %/var/log/system.log
auth.info;authpriv.info;daemon.info %/var/log/system.log
auth.info;authpriv.info |exec /usr/local/sbin/sshlockout_pf
*.emerg *

basically what im trying to say is when pfsense is booted fresh and then u go to dhcp log and u can see entries in it dhcp lease and renew etc and if u leave it as it is then entries keep increasing over time based on clients coming online and offline but suppose if u click clear log then existing ertires r removed but also no new entries r ever listed till pfsense is rebooted so the portion when clear log is clicked, that needs to be checked coz it works fine for system, firewall, ppp etc

If you restart the DHCP daemon from Status > Services, does the logging resume? What about pressing "Save" on the System Logs setting tab?

haven't tried that but ill do that and report back

tried that and after restarting dhcp daemon, logging resumes as normal.

isnt this wrong to start dhcp daemon again in order to clear log, then u might as well just name the button restart dhcp instead of clear log, if its clear log then its supposed to only clear the log file but i guess in the process the file permission goes wrong or something else after which dhcp daemon isnt able to write to the log file and thats what needs to be corrected rather than have a temporary solution of simply restarting the daemon.

Then do a little more testing and research to find out. Since you can easily replicate the issue, you can see the log file permissions before and after pressing the button.

I suspect that it isn't a permissions issue, but it needs at least a kill -HUP to reopen the file. If a kill -HUP is sufficient, then that could be done instead.

i get this is system log, no idea if its normal or no

Aug 21 16:50:48 php: /diag_logs_dhcp.php: The command '/sbin/ifconfig '' -staticarp ' returned exit code '1', the output was 'ifconfig: interface does not exist'
Aug 21 16:50:48 php: /diag_logs_dhcp.php: The command '/usr/sbin/arp -d -i '' -a > /dev/null 2>&1 ' returned exit code '1', the output was ''

Tried it myself with -HUP and the DHCP daemon just died, so that won't work. The clear_log_file() function already kills and restarts syslogd, so that alone doesn't work either. It doesn't look like we have any other choice but to restart dhcpd fully in order for logging to resume.

I don't get those interface errors. What kind of interfaces do you have assigned? When the DHCP daemon is restarted it loops through all of the interfaces on the system and tries to adjust the ARP settings there. Somehow it's picking up a blank interface. It's getting pretty far off this topic though so you might want to start a new ticket and attach a sanitized version of your config to it. If there isn't anything odd in your config I could at least check for a blank interface when calling those functions to be sure they are never called on an empty interface name.

Try this change to see if it clears up the static arp error:
https://rcs.pfsense.org/projects/pfsense/repos/mainline/commits/beeafd463ca3b2a6afac7f3e7784d059440262cd

What happens when you just clear the file instead of removing and re-creating the file? I've seen more programs having trouble using a new logfile, emptying out the original logfile almost always did the trick.

Hard to say right now since the upgrade to a new version of the DHCP daemon has caused an issue with logging.

It might be worth trying to truncate the file instead of removing, but I don't see that big of a problem with just restarting the DHCP daemon. It's not an action that will be taken very often, and the user is made aware of the action.

i guess this needs to be opened again as currently the dhcp log doesn't show anything after the upgrade

That is a completely different issue that needs a new ticket.