#3266 Log viewer doesn't return results
I'm running Webmin 1.441 on Fedora 10. I searched the Webmin Actions Log today and found no results since about May 2008.
My logging settings from the Webmin config module are:
==========
Logging active? Enable logging
Log resolved hostnames? No
Use combined log format? No
Periodically clear log files? No
Users to log: Log actions by all users
Modules to log: Log actions in all modules
Log changes made to files by each action? Yes
Record all modified files before actions, for rollbacks? Yes
Permissions for log files: Default
Also log to syslog? No
==========
And my settings in the Webmin Actions Log module are:
==========
Show source Webmin server in search results? No
==========
If I search the log using the defaults (Search in any module; For today only; Which modified any file; Any change), the result set is empty. If I change the serach period to "at any time", I see messages going back to May 16, 2008.
A quick look at the log contents doesn't show any format change between now and then. Also, I tried the search with debugging on but didn't get anything useful.
Any thoughts?
If you check the log file /var/webmin/webmin.log , do you see events since May 2008 ?
If so, one possible cause is the log index file being corrupt or out of date. You can force it to be re-generated by running :
rm /etc/webmin/webminlog/logindex*
The log shows events since May 2008. Based on your suggestion, I removed the index files and the old log file as well, so the log only shows events from today. When trying to view the log in Webmin, I still get no results. I'm attaching a copy of the log for reference.
File Added: webmin.log
Webmin log file
Sorry, but that file works fine on my system!
Could you post a few lines from the log file that did appear OK?
Jamie,
I didn't see any difference in format between the log file snippets, but here are some entries that show up correctly on the Actions Log panel:
1210959525.5362.0 [16/May/2008 13:38:45] root 2eca01d9b8151ba77908017ad3f9672d 127.0.0.1 shell index.cgi "run" "-" "-" cmd='tail -100 /var/log/messages'
1210959539.5371.0 [16/May/2008 13:38:59] root 2eca01d9b8151ba77908017ad3f9672d 127.0.0.1 shell index.cgi "run" "-" "-" cmd='tail -100 /var/log/secure'
1210959561.5377.0 [16/May/2008 13:39:21] root 2eca01d9b8151ba77908017ad3f9672d 127.0.0.1 shell index.cgi "run" "-" "-" cmd='service ldap restart'
1210959738.6618.0 [16/May/2008 13:42:18] root 2eca01d9b8151ba77908017ad3f9672d 127.0.0.1 shell index.cgi "run" "-" "-" cmd='chkconfig --list cron'
1210959744.6647.0 [16/May/2008 13:42:24] root 2eca01d9b8151ba77908017ad3f9672d 127.0.0.1 shell index.cgi "run" "-" "-" cmd='chkconfig --list crond'
1210959751.6667.0 [16/May/2008 13:42:31] root 2eca01d9b8151ba77908017ad3f9672d 127.0.0.1 shell index.cgi "run" "-" "-" cmd='service crond status'
1210959806.6947.0 [16/May/2008 13:43:26] root 2eca01d9b8151ba77908017ad3f9672d 127.0.0.1 shell index.cgi "run" "-" "-" cmd='ls /etc/cron*'
1210959824.7067.0 [16/May/2008 13:43:44] root 2eca01d9b8151ba77908017ad3f9672d 127.0.0.1 shell index.cgi "run" "-" "-" cmd='cat /etc/cron.deny'
I think the problem may be that my Webmin is configured under the Unix User Authentication page so that all users log in as the 'root' Webmin user. The current version of Webmin is writing the user's actual username to the log, but the Actions Log appears to only display entries for the effective username (in this case, root).
If that's the problem, maybe the Actions Log module could have an option to select "all users" and/or specify the user whose entries should be displayed.
Do you have any restrictions defined in the Webmin Actions Log module, limiting which users' actions can be viewed? This is setup at Webmin -> Webmin Users -> your-login -> Webmin Actions Log.
I checked that screen and it's configured for "Can view actions by users: all", although 'root' is the only user that appears. Root is the only Webmin user defined since the Unix users are configured to login as root (i.e., they enter their own ID and password, and then have root's privileges).
As long as your search is for all users, it shouldn't matter that you have other users logging in with root-equivalent privileges. At least, that works OK for me ..