RBRE960 emailing logs has string buffer bug, doesn't send the whole log, doesn't list attacks, etc.

CrimpOn 

---

CrimpOn wrote:

I, also, have two old RBR50's sending me logs.  They send "when the log is full", rather than at a specific time.  While I agree that the product should do what it says it will do, I wonder as a diagnostic effort what would happen if your 960 is set to send logs when full. (I have also found it somewhat humorous that email settings fall under Security on the older Orbi, while logs fall under Administration.  Same on the 960?)

"When Full" is of limited use for me. I liked waking up and looking at the logs to see how I was being attacked... LOL

---

Also, while there is a log setting for "Known DoS attacks and port scans" in the log settings, there is also a check box in the WAN Setup page to "Disable Port Scan and DoS Protection".  Is there a similar setting on the 960?  (Ah, yes. On page 62 of the user manual.)

I checked. The log setting to report is enabled, and the WAN setting to disable is disabled. So, it should work.

---

CrimpOn wrote:

I, also, have two old RBR50's sending me logs.  They send "when the log is full", rather than at a specific time.  While I agree that the product should do what it says it will do, I wonder as a diagnostic effort what would happen if your 960 is set to send logs when full. (I have also found it somewhat humorous that email settings fall under Security on the older Orbi, while logs fall under Administration.  Same on the 960?)

 

Also, while there is a log setting for "Known DoS attacks and port scans" in the log settings, there is also a check box in the WAN Setup page to "Disable Port Scan and DoS Protection".  Is there a similar setting on the 960?  (Ah, yes. On page 62 of the user manual.)

 

 I could not help but notice your 960 appears to be connecting to the Internet a lot. All those "internet Conected" followed by "Time Synchronized" entries.  Since they all appear in the log, it is clear that the 960 did not reboot (which would clear the log).

 

---

Yes, I noticed that, too. RBR50 used to sync time with the NTP server once a day or once per reboot or something like that, and that didn't trigger an "Internet Connected" entry in the log. It seems RBRE960 feels the need to sync the time wayyyyyyy more frequently and a Internet Connected line is written into the log just before that happens. They certainly are not reboots.

While there, let me say that I hate that the log clears at reboot. Yikes! The log leading up to a crash resulting in a reboot is valuable! Like, that is a no brainer. The fact that there isn't the slightest amount of non-volatile memory in this expensive hardware to store the log in a way that is persisted across crashes & reboots, and reported properly is insane!

Tuna