20 GB of Logs Per Week?

[Guest]

[Syntax42]

I have been preparing to deploy EFW Community for my small business.  After configuring nearly every aspect to my liking, I noticed the log partition was full.  I haven't had it running for a full week in my test environment.

After further investigation, I found two major issues.

First, OpenVPN is the source of the full logs partition.  I was using it to do most of my configuration so I could stay connected to my primary network.  The OpenVPN log file is 12 GB in size in /var/log/openvpn and the /var/log/archives/openvpn log file is most of the rest of the 8 GB of my partition..  I'm fairly sure the logs only started to do this when I switched OpenVPN to run on TCP port 443 with the anticipation of remote users needing to make their traffic look close enough to HTTPS to bypass most firewalls.  I'm still looking in to how to decrease the verbosity for OpenVPN so this doesn't happen in the future.

The second issue is that EFW was not set up to automatically delete older logs in order to free up space.  Referring to ( help.endian.com/entries/21457211-How-to-avoid-running-out-of-disk-space-to-store-log-files ) , Endian should be doing that automatically.  However, the settings file referenced did not exist until after I went into Logs -> Settings and saved the settings for the first time.  Even then, the "LOGS_FREE_PERCENTAGE=10" line did not exist.  I added it manually and rebooted, but it didn't seem to trigger the process which frees up space.

After I reduce OpenVPN's verbosity, my logs should fill up much slower.  I should have plenty of time to delete old logs manually if the system isn't able to do so.  I will post here again after I figure out how to reduce the verbosity.  I'm thinking it is a simple setting in the config file.

[Syntax42]

This is not making much sense.  The only thing I changed was the creation of the /var/efw/logging/settings file by saving the settings once, and I manually deleted the 12 GB and 8 GB OpenVPN log files.  I also re-made the live log file as an empty file. 

Before doing that, my CPU load on the status page was 30% for both cores whenever I had an OpenVPN connection active.  Now, the CPU load is near zero and my OpenVPN logs are not being filled at a rate I would consider excessive or even close to something that would produce 100 MB in a day, let alone 10 GB. 

If the creation of the log settings file fixed it, I don't understand how.  Another thought is the permissions on the OpenVPN log were not right, but that doesn't make much sense either.  My final thought is someone was trying to break in to my system last night and caused the logs to fill rapidly.

Has anyone experienced this issue?

[Syntax42]

It happened again today, but I finally figured it out.  A different program on my client computer was attempting to access the VPN interface.  The program was MxTunnel and is another VPN client used with a BarracudaDrive server.  I don't know why it was trying to connect to the Endian OpenVPN server.  It should have only been running in the background, waiting for me to turn it on, but it seemed to activate itself when I locked my desktop.

Hopefully someone else who comes across this will be able to resolve their issue faster.