Project

General

Profile

Bug #24090

Log from last year sent again in the same day current year

Added by Gino Latilla almost 4 years ago. Updated about 3 years ago.

Status:
Closed: Duplicate
Priority:
No priority
Assignee:
Sean Fagan
Category:
Middleware
Target version:
N/A
Seen in:
11.0-U4
Severity:
New
Reason for Closing:
Reason for Blocked:
Needs QA:
Yes
Needs Doc:
Yes
Needs Merging:
Yes
Needs Automation:
No
Support Suite Ticket:
n/a
Hardware Configuration:
ChangeLog Required:
No

Description

Error log from last year is sent again to mail address configured for alert when the same day arrive.
example: 20 may 2016 failed login is logged, the system sent me this alert at the right time in 2016. Now the system sent again the same alert on 20 may 2017.

Because of this, is impossible to understand which error is "true" and which are simply message from last year

Related issues

Is duplicate of FreeNAS - Bug #18615: Skip old login failures in daily security run outputResolved2016-10-29

History

#1 Updated by Sean Fagan almost 4 years ago

  • Status changed from Unscreened to Closed: Insufficient Info

Attach a system debug, otherwise there's insufficient information.

#2 Updated by Gino Latilla almost 4 years ago

  • File debug-FCStorage-20170522230017.tgz added

Debug is attached now

RECEIVED MAIL:
May 21 14:05:45 FCStorage sshd45536: Invalid user rootn from *****
May 21 14:05:45 FCStorage sshd45536: input_userauth_request: invalid user rootn [preauth]
May 21 14:05:48 FCStorage sshd45536: Failed password for invalid user rootn from ***** port 25227 ssh2
May 21 14:05:51 FCStorage sshd45536: Failed password for invalid user rootn from ***** port 25227 ssh2
May 21 14:05:51 FCStorage sshd45536: Failed password for invalid user rootn from ***** port 25227 ssh2
May 21 14:05:59 FCStorage sshd45536: Failed password for invalid user rootn from **** port 25227 ssh2

ACTUAL LOG:
May 21 13:52:39 FCStorage alert.py: [common.pipesubr:66] Popen()ing: /usr/local/sbin/dmidecode -s baseboard-product-name
May 21 14:52:58 FCStorage alert.py: [common.pipesubr:66] Popen()ing: /usr/local/sbin/dmidecode -s system-product-name

#3 Updated by Dru Lavigne about 3 years ago

  • File deleted (debug-FCStorage-20170522230017.tgz)

#4 Updated by Dru Lavigne about 3 years ago

  • Target version set to N/A

#5 Updated by Gino Latilla about 3 years ago

  • Subject changed from Log from last year sent again in the same day to Log from last year sent again in the same day current year

Debug was attached. What other info do you need?
The same problem happened again today.

In 5 december 2016 I had failed login, then today, 5 december 2017, the log from this day in 2016 are sent again.

The log auth.log is only one and inside it contain all log, without cycling, in the format "month day".

The problem still present in the system after updated to FreeNAS-11.0-U4 (54848d13b)

#6 Updated by Dru Lavigne about 3 years ago

  • Status changed from Closed: Insufficient Info to 15

That bug was fixed some time ago. Please attach a debug from the 11.0-U4 system.

#7 Updated by Gino Latilla about 3 years ago

  • File debug-FCStorage-20171205140601.tgz added
  • Seen in changed from 9.10.2-U3 to 11.0-U4

Log attached. Thank you

#8 Updated by Dru Lavigne about 3 years ago

  • Status changed from 15 to Closed: Duplicate

OK, found the fixed ticket, looks like it was fixed for 11.1-BETA1. Once you have a chance to update to 11.1 (due out in the next few days), the issue should be resolved for you.

#9 Updated by Dru Lavigne about 3 years ago

  • File deleted (debug-FCStorage-20171205140601.tgz)

#10 Updated by Dru Lavigne about 3 years ago

  • Is duplicate of Bug #18615: Skip old login failures in daily security run output added

Also available in: Atom PDF