Module: Event Logging

Re: Module: Event Logging = IPV6 IP addresses truncated to 15 chars

Steve H — Tue, 19 Jul 2022 22:18:34 -0500

I solved my own problem. It was a client issue. My web browser was blocking them with the Ghostery extension.

Re: Module: Event Logging = IPV6 IP addresses truncated to 15 chars

Steve H — Tue, 19 Jul 2022 18:58:03 -0500

I am having an issue with the latest version of this module (and phorum)

The small icons for Debug/Info/Warning/Error/Alert which reside in mods/event_logging/images/loglevels/ are not displaying on the "view logged events" and "filter logged events" pages. However, if I right-click the broken links and select "open image in new tab" they open up fine.

???

Re: Module: Event Logging

Emmanuel Bigler — Mon, 05 Oct 2015 06:28:14 -0500

Oops ! Sorry for the late answer !
Many thanks to Oliver for correcting the event_logging module so that it can correctly display long IPV6 addresses.

I'll try the new version 1.0.9

THANKS!

Re: Module: Event Logging

Oliver Riesen-Mallmann — Thu, 10 Sep 2015 08:11:22 -0500

Hi deepvision,

Quote
deepvision
I am using the latest phorum and the latest event logging module and keep getting
You are accessing the admin after a security timeout.
every time I click on an event source link in the event log. Even if I opened the event list only a second ago every time I click on any event source link I get the message above.

I corrected this bug in version 1.0.9.

Regards
Oliver

Re: Module: Event Logging = IPV6 IP addresses truncated to 15 chars

Oliver Riesen-Mallmann — Thu, 10 Sep 2015 07:31:57 -0500

Hi Emmanuel,

you are using version 1.0.7. There was a wrong version number in one of the module files.

Quote
Emmanuel Bigler
I have noticed in event logs that IPV6 logged IP addresses are truncated to 15 characters like for an IPV4.
IPV6 addresses show up correctly to moderators in posted messages, but not in event logging.
IPV6 addresses need something like 39 characters.

The database column for the ip address has only 15 characters. ipv6 needs up to 45 characters.

I updated the Event Logging Module to version 1.0.8.

Regards
Oliver

Re: Module: Event Logging = IPV6 IP addresses truncated to 15 chars

Emmanuel Bigler — Thu, 30 Apr 2015 08:27:41 -0500

Hello from France
This is my first post here.

I'm using Phorum version 5.2.19 with Event Logging version 1.0.8

I have noticed in event logs that IPV6 logged IP addresses are truncated to 15 characters like for an IPV4.
IPV6 addresses show up correctly to moderators in posted messages, but not in event logging.
IPV6 addresses need something like 39 characters.

How can this be corrected? Thanks !

Re: Module: Event Logging

Scott Finegan — Sun, 24 Aug 2014 13:23:40 -0500

Thomas

I can confirm there is an issue with event logging in 5.2.1.9. I also did a fresh install that has the issue.
I am unable to determine the cause.

To reproduce.
Admin / Mods
Enable the Event Logging module... Save
On the Event Logging Settings page... Save
Do something to create an event, I logged in to the Phorum from another browser.
Go to View Logged Events

Click on a Source or Category link to refine the filter...
or open a Detail and click on an IP to refine the filter.

Re: Module: Event Logging

Scott Finegan — Fri, 06 Jun 2014 12:36:14 -0500

I haven't looked at how that code works, but I suspect you may have a cookie issue.
My session times out about 5 minutes.

Re: Module: Event Logging

deepvision — Fri, 06 Jun 2014 01:09:47 -0500

I am using the latest phorum and the latest event logging module and keep getting

You are accessing the admin after a security timeout.

every time I click on an event source link in the event log. Even if I opened the event list only a second ago every time I click on any event source link I get the message above.

Re: Module: Event Logging

sheik — Wed, 17 Oct 2012 08:09:57 -0500

As far as I can tell my event log is now being restricted to 1000 entries.

If anybody would like to have a more convenient link to the EVent Viewer in Admin, you can apply the following patch:

/phorum/mods/event_logging/info.txt
add this to the bottom of the file:

hook: admin_menu|phorum_mod_event_logging_admin_menu

/phorum/mods/event_logging/event_logging.php
add this to the bottom of the file (but before the closing ?> tag!)
[code="php"]
function phorum_mod_event_logging_admin_menu($pos)
{
$menu = new PhorumAdminMenu("Events");
$menu->addCustom(
"Event log",
html_entity_decode(phorum_admin_build_url(array(
'module=modsettings',
'mod=event_logging',
'el_action=logviewer'
)))
);
$pos->appendLast($menu->getHtml());
return $pos;
}[/code]

(I grabbed this code from [www.phorum.org] but please note the call to html_entity_decode(). This seems to be required as otherwise the generated link contains & instead of &, and is therefore broken)

/\dam

Re: Module: Event Logging

sheik — Sun, 14 Oct 2012 13:34:00 -0500

That's really good to know, thanks.

I can't explain why I upgraded to 5.2.19, enabled the event logger with a maximum number of entries of 1000 and had 400,000 entries the next day though?

The vast majority of my errors were PHP ones caused by an old banner module that hadn't been upgraded I think.
Does the transparent pixel get called on every public-facing Phorum page or only on some of them?

/\dam

Re: Module: Event Logging

Thomas Seifert — Sun, 14 Oct 2012 04:10:45 -0500

in 2009 automatic garbage collection was added with a transparent pixel which does that task asynchronously.

Re: Module: Event Logging

sheik — Sat, 13 Oct 2012 18:30:59 -0500

OK, thanks - so it sounds like since this thread started, later versions of Phorum have been altered to flush the event table outside of the admin.
it would be good to get a Phorum dev to comment on why this may have not worked for me. Maybe debug level is an exception?

/\dam

Re: Module: Event Logging

DavidVonB — Sat, 13 Oct 2012 17:44:59 -0500

Minimum log level is warning

Have the following items checked
A moderator deletes message(s) from a forum
A moderator disapproves and hides message(s)
All of the - Software events (especially interesting for developers)

Just had 500 records in the table on my backup machine (which I didn't read)
about 20 days worth.

Re: Module: Event Logging

sheik — Sat, 13 Oct 2012 13:22:24 -0500

Quote
David Von B
I keep a max of 500 events and the old ones do get dropped off (this results in a 1.6M table size).

All I know is what has been said earlier in this thread:

Quote
Thomas
hmm, deletion of logs seems to be only done on checking the logviewer in the module settings.

...and that the day after I enabled this mod I had something like 400,000 records in the event logger table (which had defaulted to run in "debug" mode which is maximum logging - again, I personally think there should be clearer warnings that this setting can generate a *lot* of entries).

I'm interested that you say your max events to log is working though. I assume you have checked this in the DB directly without going to the logviewer first? As otherwise you could have more than you realise, but the Event Viewer truncates the table when you go to view them in Phorum?
If that's not the case, I'd like to know why your event logging module is working how I'd like mine to! :-)

/\dam

Re: Module: Event Logging

DavidVonB — Sat, 13 Oct 2012 05:13:27 -0500

"Maximum amount of stored event logs" is the number of events that are stored, not the amount of storage to use.

I feel it should be made clearer that "automatically" actually means "when you view the logs". - this works, I keep a max of 500 events and the old ones do get dropped off (this results in a 1.6M table size).

Re: Module: Event Logging

sheik — Fri, 12 Oct 2012 05:39:31 -0500

I am a longtime contributor to these forums but have been absent since about version 5.2.9 :-(.
I have recently upgraded and that went very smoothly, thank you Phorum team!

However, last night I installed the StopPhorumSpam module and noticed it did logging, so I enabled the Event Logger.
This morning my server had crashed as the phorum_event_logging table had eaten up all my disk quota.
Like the OP, I had assumed that setting a maximum number of events to log would prevent that from happening.
I've had to spend about an hour on the phone with my provider to get a temporary quota high enough to repair all my corrupted tables and optimise phorum_event_logging back to a sane number of records.

I'm in no way complaining about this, I just want to warn other users to be careful.

Also, I think the module popup help text should be reworded:

Quote
Phorum help text
Maximum amount of stored event logs
This option configures the maximum amount of event logs that can be stored in the database at a given time. If the amount of event logs grows larger than this configured maximum, then old entries will be automatically cleaned up.

I feel it should be made clearer that "automatically" actually means "when you view the logs".

Also, I would like some advice on how I can still use the event logger without having to worry about disk space.
Does anybody have a script I can use with a cronjob that hooks into the maximum log value set by the user and truncates the table to that value?

Thank you,

/\dam

Re: Module: Event Logging

DJ Maze — Sun, 30 Nov 2008 12:20:45 -0600

Maybe write a cronjob that gets run once a day to remove entries older then X days?

Re: Module: Event Logging

Ulf Dunkel — Sun, 21 Sep 2008 08:31:28 -0500

@Maurice: I agree with your explanations. :-)

Re: Module: Event Logging

Maurice Makaay — Sun, 21 Sep 2008 08:21:02 -0500

Writing it to the database is by far the best option, since it won't cause trouble with file permissions and best of all: it makes the logs searchable through SQL queries. When logging to files (e.g. to the apache error log by spitting out log messages on STDERR), we'd loose the opportunity to view the log messages easily through the admin interface. And being able to view log messages in there was one of the big goals, because we get questions all the time for which we'd love to see logging, but where the user does not know how to get to the PHP logging.

@Azumandias: I agree, but since the module does currently not clean up the logs, my statement stands. When we make changes to do some cleanup on other occasions as well, then it's of course okay to let the logs flow.
With 4.5 million entries, it looks like the module's logging info isn't really used though.

Re: Module: Event Logging

Ulf Dunkel — Sun, 21 Sep 2008 07:46:36 -0500

Hi Maurice,

of course I already switched the module OFF for now and also cleared the relevant MySQL table. But - the option to set up a maximum amount is rather irritating if it isn't used somehow, isn't it?

I would appreciate if the log stuff would not be written to the MySQL table but instead into something like the well-known log files in Apache. Is this a better approach or is writing to physical files on the servers hard drive even more "expensive" in terms of load and time?

Re: Module: Event Logging

Joe Curia — Sun, 21 Sep 2008 07:29:56 -0500

Quote
Maurice Makaay
If you do not look at the logs, then better disable the module completely.

As a sys admin I disagree with this statement. On many of programs I have logging enabled to store a couple days worth of data. If everything runs smoothly, I never look at the data. However, if there is an issue, I generally hear about it within that day or two before the log data gets deleted. Then I can confidently open the logs, knowing the data I need will be there. I don't have a ready idea for how to balance the overhead with the need for a certain period of logs, except to have the option of saving X days of logs and deleting any older logs on every common.php load. It might be overhead, but it should be spread out some.

Re: Module: Event Logging

Maurice Makaay — Sun, 21 Sep 2008 06:15:12 -0500

Thomas is right. Handling that at log time makes the module do more queries on the front end than I'd want it to. If you do not look at the logs, then better disable the module completely.

Re: Module: Event Logging

Thomas Seifert — Sun, 21 Sep 2008 06:09:08 -0500

hmm, deletion of logs seems to be only done on checking the logviewer in the module settings.
guess its to expensive to run on each pageview.
Maybe maurice can comment on this further.

Module: Event Logging

Ulf Dunkel — Sun, 21 Sep 2008 06:02:54 -0500

I am using Phorum 5.2.7 and wondered why my weekly Phorum database backups for a single phorum installation have already grown to about 3.3 GB!

So I checked which table was the biggest and saw, that the _event_logging table had already collected about 4.500.000 (!) entries, although I had set up "Maximum amount of stored event logs" to 500 (Debug level, every event option checked).

Is this a known issue?