DD-WRT :: View topic - Truncated Firewall log entries

Truncated Firewall log entries

DD-WRT Forum Index -> General Questions

Author

Message

Rickers
DD-WRT User

Joined: 10 May 2015
Posts: 148

Posted: Wed Nov 06, 2024 2:20 Post subject: Truncated Firewall log entries
Firewall log entries get truncated. Whether it's at 235, 255, 275 characters not sure depending on where I look at the entries. Is there a configurable item to increase the buffer size/width to stop this? Regards, Rick

Sponsor

Rickers
DD-WRT User

Joined: 10 May 2015
Posts: 148

Posted: Sun Apr 20, 2025 11:44 Post subject:
How can I file a request to do this? Thanks, R

kernel-panic69
DD-WRT Guru

Joined: 08 May 2018
Posts: 16208
Location: Texas, USA

Posted: Mon Apr 21, 2025 15:58 Post subject:

Is this in the output of /var/log/messages, remote syslog, the webUI syslog pages? All pertinent information with an example would surely help. I've queried the developer on this.
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
RSS feed for DD-WRT releases (2025)
RSS feed for DD-WRT releases (2024)
RSS feed for DD-WRT releases (2023)
----------------------
Linux User #377467 counter.li.org / linuxcounter.net

BrainSlayer
Site Admin

Joined: 06 Jun 2006
Posts: 7729
Location: Dresden, Germany

Posted: Mon Apr 21, 2025 18:51 Post subject: Re: Truncated Firewall log entries

Rickers wrote:

Firewall log entries get truncated. Whether it's at 235, 255, 275 characters not sure depending on where I look at the entries.

Is there a configurable item to increase the buffer size/width to stop this?

Regards, Rick

dont know what you are talking anbout. syslog, gui, dmesg. unclear. i also dont know what you mean with XXX characters.
_________________
"So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s

BrainSlayer
Site Admin

Joined: 06 Jun 2006
Posts: 7729
Location: Dresden, Germany

Posted: Mon Apr 21, 2025 18:51 Post subject:

Rickers wrote:

How can I file a request to do this?
Thanks, R

???? request?

files can be uploaded here in the forum. but i'm not sure if i understand you correct.
_________________
"So you tried to use the computer and it started smoking? Sounds like a Mac to me.." - Louis Rossmann https://www.youtube.com/watch?v=eL_5YDRWqGE&t=60s

Rickers
DD-WRT User

Joined: 10 May 2015
Posts: 148

Posted: Tue Apr 22, 2025 3:45 Post subject:

Here's a few lines from /var/log/messages on my 1900ACv1 (this is identical to the format in Status/Syslog tab):

Code:

Apr 21 23:21:39.161 DD-WRT kern.warn kernel: [ 3832.899461] ACCEPT IN=br0 OUT= MAC=14:91:82:35:34:2f:a8:20:66:3a:50:3f:08:00 SRC=192.168.1.110 DST=192.168.1.1 LEN=96 TOS=0x08 PREC=0x40 TTL=64 ID=0 DF PROTO=TCP SPT=63524 DPT=22 SEQ=4218929951 ACK=2722779460 WINDOW=2048 RES=
Apr 21 23:21:42.541 DD-WRT kern.warn kernel: [ 3836.278708] ACCEPT IN=br0 OUT= MAC=14:91:82:35:34:2f:a8:20:66:3a:50:3f:08:00 SRC=192.168.1.110 DST=192.168.1.1 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=64014 DPT=80 SEQ=724809870 ACK=0 WINDOW=65535 RES=0x00 SYN
Apr 21 23:21:43.171 DD-WRT kern.warn kernel: [ 3836.907239] ACCEPT IN=br0 OUT=tun1 MAC=14:91:82:35:34:2f:a8:20:66:3a:50:3f:08:00 SRC=192.168.1.110 DST=178.162.170.166 LEN=238 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=62549 DPT=443 SEQ=708859433 ACK=2701862500 WINDOW=

The first and third lines are obviously truncated. Can that be fixed to show the entire line of data?
Thanks, Rick

kernel-panic69
DD-WRT Guru

Joined: 08 May 2018
Posts: 16208
Location: Texas, USA

Posted: Tue Apr 22, 2025 3:59 Post subject:

All entries begin with a date / time stamp. Everything after the date until the next line that starts with a date / time stamp is all one line entry. I usually have to have PuTTY window fullscreen, and even then, there's 'truncated lines'. This is nothing new and probably won't be corrected.
_________________
"Life is but a fleeting moment, a vapor that vanishes quickly; All is vanity"
Contribute To DD-WRT
Pogo - A minimal level of ability is expected and needed...
RSS feed for DD-WRT releases (2025)
RSS feed for DD-WRT releases (2024)
RSS feed for DD-WRT releases (2023)
----------------------
Linux User #377467 counter.li.org / linuxcounter.net

Rickers
DD-WRT User

Joined: 10 May 2015
Posts: 148

Posted: Tue Apr 22, 2025 5:23 Post subject:

I was responding to BS, so let's see what he says.

If I look at the same exact log data sent to a remote syslog, it looks like this:

Code:

<4>Apr 22 03:21:39 kernel: [ 3832.899461] ACCEPT IN=br0 OUT= MAC=14:91:82:35:34:2f:a8:20:66:3a:50:3f:08:00 SRC=192.168.1.110 DST=192.168.1.1 LEN=96 TOS=0x08 PREC=0x40 TTL=64 ID=0 DF PROTO=TCP SPT=63524 DPT=22 SEQ=4218929951 ACK=2722779460 WINDOW=2048 RES=
<4>Apr 22 03:21:42 kernel: [ 3836.278708] ACCEPT IN=br0 OUT= MAC=14:91:82:35:34:2f:a8:20:66:3a:50:3f:08:00 SRC=192.168.1.110 DST=192.168.1.1 LEN=64 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=64014 DPT=80 SEQ=724809870 ACK=0 WINDOW=65535 RES=0x00 SYN
<4>Apr 22 03:21:43 kernel: [ 3836.907239] ACCEPT IN=br0 OUT=tun1 MAC=14:91:82:35:34:2f:a8:20:66:3a:50:3f:08:00 SRC=192.168.1.110 DST=178.162.170.166 LEN=238 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=62549 DPT=443 SEQ=708859433 ACK=2701862500 WINDOW=

The prefix part of it with the date is shorter than in /var/log/messages, but the data itself is truncated at the same spot meaning it was most likely truncated before it was logged.

Display posts from previous:

Page 1 of 1

DD-WRT Forum Index -> General Questions

All times are GMT

Navigation

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum

Log in

Truncated Firewall log entries

Quick Links

Log in