NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
RBRE960 emailing logs has string buffer bug, doesn't send the whole log, doesn't list attacks, etc.
I was doing this on my RBR50 for the last 2.5 years: Every 3am, email me the log. That also resulted in the log getting reset, so every morning I would have a copy of the previous day's log in my ema...
I view "Internet Connected" as the key log entry. There will always be a Time Sync immediately after the internet connection. "Hey, I'm on the internet. Wonder what time it is?" I'd put money on NTP not having anything to do with the Connection happening. There is some other cause. Since I keep all these logs, I just searched. My Orbi put "Internet connected" into the log file on Monday, Dec 13.
My Orbi has been 'up' for 119 days (since Nov 25, 2021) and during that time it has 'connected' to the internet 3-4 times. The last time being Dec 13, 2021. In every case after Nov 25, there was a 'disconnected' message immediately before the 'connected'.
A word about "Full" vs. at a certain time. It is pretty clear that there is a maximum log file size. (Hence the concept "full".) If a log is send once per day, it will be either (a) not completely full yet, or (b) have gone past full and wrapped around, and thus an unknown number of log entries have been written over. Most days, it takes more than 24 hours to fill my log files, so once per day would be convenient. I find several emails, however, that came in less than 24 hours. Since the number of DHCP lease renewals is pretty much constant, the major difference is the number of DoS entries. When some A**H*** out there decides to go fishing, the logs can fill really quickly.
Anyway, the question is more about diagnostics rather than the end goal. If 'when full' actually works, that is a ton better than an email with 9 lines of drivel.
No dice. Since I switched to "email when full" few days back on Friday, just now, this Wednesday 5am, I received my first log email, only containing a whopping 11 lines, from Sunday morning... đ
[DHCP IP: (192.168.1.7)] to MAC address <redacted>, Sunday, Mar 27,2022 06:34:23
[Time synchronized with NTP server] Sunday, Mar 27,2022 06:18:51
[Internet connected] IP address: <redacted>, Sunday, Mar 27,2022 06:18:51
[DHCP IP: (192.168.1.73)] to MAC address <redacted>C, Sunday, Mar 27,2022 06:17:58
[Time synchronized with NTP server] Sunday, Mar 27,2022 05:18:50
[Internet connected] IP address: <redacted>, Sunday, Mar 27,2022 05:18:50
[Time synchronized with NTP server] Sunday, Mar 27,2022 04:48:49
[Internet connected] IP address: <redacted>, Sunday, Mar 27,2022 04:48:49
[DHCP IP: (192.168.1.64)] to MAC address <redacted>, Sunday, Mar 27,2022 04:46:58
[Time synchronized with NTP server] Sunday, Mar 27,2022 03:48:49
[Internet connected] IP address: <redacted>, Sunday, Mar 27,2022 03:48:48The current live log on RBRE960 ranges between:
[Admin login] from source 192.168.1.59, Wednesday, Mar 30,2022 06:50:38
. . . .
[DHCP IP: (192.168.1.12)] to MAC address <redacted, Monday, Mar 28,2022 07:06:17
So, it feels like the router tried to email only entries from Friday through Monday morning, even though it did that on Wednesday morning, but failed to send all of it, yet seemingly still truncated the Fri-to-Mon morning entries from the log, instead of emailing everything properly and resetting the log to empty.
Tuna
Orbi 900 series has not properly E-Mailed router logs since day 1.
Engineers are aware of the issue. Hopefully they are working on it.
I agree with Mikey94025 If you have any time left on the "complimentary" 90 days of support, open a ticket with Netgear support. Would be fun if you could pry some sort of acknowledgement out of them that the problem is actually being worked on. Maybe even a case number or something.
