'Auth.log' Log file filling up

Need support for GhostBSD. Ask here if your question does not fit elsewhere.

'Auth.log' Log file filling up

Postby NeverSimple » Sat Sep 16, 2017 2:58 pm

I noticed today that /var/log/auth.log is steadily growing in size. Every hour it rolls over due to size.
Basically there are only two lines in there:

Code: Select all
Sep 16 20:42:19 ghostbsd doas: rherman ran command ifconfig wlan0 as root from /usr/home/rherman
Sep 16 20:42:19 ghostbsd doas: root ran command ifconfig wlan0 as root from /root


These two line repeat 10 times with the same timestamp, so 20 log entries. then it stops for 15 seconds after which it repeats with the same 20 log entries. This keeps going on hour after hour.

I Have two machines running GhostBSD 11.1, one on ALPHA1, the other on BETA1. Both exhibit this behaviour.
Any idea where this is coming from?
NeverSimple
 
Posts: 27
Joined: Sun Aug 20, 2017 9:08 am
Has thanked: 3 times
Been thanked: 1 time

'Auth.log' Log file filling up


Re: 'Auth.log' Log file filling up

Postby ASX » Sat Sep 16, 2017 3:13 pm

That is most likely a side effect of network manager, that peridodically scan for available wifi networks.
ASX
Developer
 
Posts: 942
Joined: Wed May 06, 2015 11:46 am
Has thanked: 53 times
Been thanked: 122 times

Re: 'Auth.log' Log file filling up

Postby NeverSimple » Sat Sep 16, 2017 3:46 pm

Really? That seems a bit excessive. Especially since none of these machines has a WiFi adapter.
NeverSimple
 
Posts: 27
Joined: Sun Aug 20, 2017 9:08 am
Has thanked: 3 times
Been thanked: 1 time

Re: 'Auth.log' Log file filling up

Postby ASX » Sat Sep 16, 2017 4:31 pm

if you don't need network manager, simply disable it.
In XFCE you need to look into settings -> startup, I don't know about MATE but should not be much difficult to find where is started. ;)

EDIT: the first time you connect to a wifi network you don't want to wait too much, so the timing is a tradeoff.
ASX
Developer
 
Posts: 942
Joined: Wed May 06, 2015 11:46 am
Has thanked: 53 times
Been thanked: 122 times

Re: 'Auth.log' Log file filling up

Postby WytWun » Sun Sep 17, 2017 3:20 am

I may not be looking in the correct place, but if the network manager is relying on /usr/local/share/networkmgr/net_api.py then it seems to me that there might be something amiss.

There are several functions in that file that check for the presence of the wlan0 interface and return an appropriate status (True == exists | active; False == absent | inactive). My VM instance of BETA1 is showing the same activity on wlan0 that NeverSimple is seeing and there's no wireless lan interface in the VM (or the host for that matter). I don't have time to pursue this further at the moment...
WytWun
 
Posts: 13
Joined: Sat Aug 12, 2017 7:54 am
Has thanked: 0 time
Been thanked: 2 times

Re: 'Auth.log' Log file filling up

Postby kraileth » Wed Sep 20, 2017 3:17 pm

To me it would make sense if doas supported suppressing log messages for certain commands. However I don't think that it has such a feature. Yet?
kraileth
Developer
 
Posts: 301
Joined: Sun Sep 04, 2016 11:30 am
Has thanked: 53 times
Been thanked: 49 times

Re: 'Auth.log' Log file filling up

Postby NeverSimple » Wed Sep 20, 2017 3:25 pm

kraileth wrote:To me it would make sense if doas supported suppressing log messages for certain commands. However I don't think that it has such a feature. Yet?


Well, to me it would not make sense supressing these messages. They shouldn't be generated in the first place, right?
Why would running 'ifconfig wlan0' make sense on a machine that has no wlan0? (or any wlan capability)
I think 'WytWun' is right: something is not quit right here.
NeverSimple
 
Posts: 27
Joined: Sun Aug 20, 2017 9:08 am
Has thanked: 3 times
Been thanked: 1 time

Re: 'Auth.log' Log file filling up

Postby ASX » Wed Sep 20, 2017 5:05 pm

NeverSimple wrote:
kraileth wrote:To me it would make sense if doas supported suppressing log messages for certain commands. However I don't think that it has such a feature. Yet?


Well, to me it would not make sense supressing these messages. They shouldn't be generated in the first place, right?
Why would running 'ifconfig wlan0' make sense on a machine that has no wlan0? (or any wlan capability)
I think 'WytWun' is right: something is not quit right here.


The network manager may be far from perfect, but it does some good job which is (or will be) separate into two pieces:
a) detect a wifi adapter, including USB dongles that could be plugged in at any time, and configure the related driver in rc.conf
b) managing the connection to the wifi network

both things require a periodic scan, hope that explain the underlying requirements.
The excessive logging can be annoying, but it is a minor issue. ;)
ASX
Developer
 
Posts: 942
Joined: Wed May 06, 2015 11:46 am
Has thanked: 53 times
Been thanked: 122 times

Re: 'Auth.log' Log file filling up

Postby kraileth » Wed Sep 20, 2017 11:58 pm

NeverSimple wrote:Well, to me it would not make sense supressing these messages. They shouldn't be generated in the first place, right?
Why would running 'ifconfig wlan0' make sense on a machine that has no wlan0? (or any wlan capability)
I think 'WytWun' is right: something is not quit right here.


That's actually two different things: Yes, extending the network manager so that it doesn't try to use wlan at all on system where it's not desired (or even possible) would be a nice feature. But then there are probably a lot of systems where you would actually want to scan for wlans. And in that case the logging "problem" still exists. A agree with ASX here: On a desktop workstation it's probably a minor thing for most people. However for security-minded folks who actually check their logs it could be a real nuisance.

I'm opening a ticket for the network manager side of the affair. If somebody wants the doas part fixed, too, he or she needs to find a volunteer with some C coding experience (and preferably somebody who's able to convince the Ted Unangst and the OpenBSD guys to accept a patch upstream :mrgreen: ).
kraileth
Developer
 
Posts: 301
Joined: Sun Sep 04, 2016 11:30 am
Has thanked: 53 times
Been thanked: 49 times

Re: 'Auth.log' Log file filling up

Postby ASX » Thu Sep 21, 2017 3:12 am

kraileth wrote:If somebody wants the doas part fixed, too, he or she needs to find a volunteer with some C coding experience (and preferably somebody who's able to convince the Ted Unangst and the OpenBSD guys to accept a patch upstream).


Some suicide attitude is needed to ask something that (removing logging) to OpenBSD! :D
ASX
Developer
 
Posts: 942
Joined: Wed May 06, 2015 11:46 am
Has thanked: 53 times
Been thanked: 122 times

Next

Return to General support

Who is online

Users browsing this forum: No registered users and 1 guest