Re: Orbi not logging activity as specified

CrimpOn · ‎2018-10-15

Since the firmware update to 2.2.1.210, my Orbi seems to log ONLY DHCP assignments, admin logins, when it sends a log file, and time synchronization. It NO LONGER logs known DOS attacks and port scans. The box is clearly checked. I have attempted to "fool" the Orbi by clearing all the check boxes, "applying", then checking the boxes and "applying" again. No change. I searched for "log" in the community forum and found nothing relating to this.

Is this a known issue?
Is there a fix?

Thanks

FURRYe38 · ‎2018-10-15

Try manually loading FW and resetting factory defaults and set up from scratch. See if the logs gather what your looking for...

CrimpOn · ‎2018-10-15

I understand that when "turn the damn thing off and back on again" doesn't work, the ultimate solution is to "reinstall everything from scratch."

I still would like to know "am I the ONLY person whose Orbi does not log intrusion attempts as it did before the firmware update?"

FURRYe38 · ‎2018-10-16

Seems to be unless nobody else is using this feature at the moment...

RocketSquirrel · ‎2018-10-16

I see absolutely nothing in my Orbi log other than admin logins. I think the logger is broken. My Orbi is in AP mode for what that’s worth.

CrimpOn · ‎2018-10-16

When in Access Point mode, there isn't much an Orbi can log. For example, DHCP requests are handled by a router, not an AP. When I go through the list of things that can be logged, almost everything I see pertains to router functions, not AP's. I'm not even certain that an AP needs to know what time it is.

I wish Netgear's documentation provided information about what these log categories include. For example, what the heck is "wireless access"? I've NEVER seen a log entry like that, although my "assumption" is that it would be logging every time a new device connected to the Orbi.

Thanks for posting.

RocketSquirrel · ‎2018-10-16

When I telnet into my main Orbi and invoke /usr/bin/logger, nothing gets added to /var/log/messages.

CrimpOn · ‎2018-10-16

I agree. When I telnet to the router, nothing shows in the log. In this case, I think their description is accurate:

"Connections to the Web-based interface of this Router"

Looks like they mean what they say. Browse into Orbi and they log it. Telnet (or what else?) and they don't. Guess I could scan what ports are open.

RocketSquirrel · ‎2018-10-16

What I meant was, the program which is supposed to write to the log does not actually write to the log.

The program is /usr/bin/logger. You should be able to type to the shell

logger 'Some log message'

and have that text appear at the bottom of the log file, which is /var/log/messages. But it does not.

CrimpOn · ‎2018-10-17

Correct. logger does not work. Which is in addition to the router clearly (a) not doing what it did before the firmware update, which means (b) not logging the things the web page says it does. In addition, it seems a bit short-sighted to log "access to the web interface" but not telnet (or ssh?) access. Actually, I can see why they would not log telnet. Because telnet is on the debugging page that "normal" users would never see. So, maybe that's not as much of an oversight.

Makes it sort of a mystery how they get messages into the system log.

ekhalil · ‎2018-10-17

Directly after upgrade to 2.2.1.210 I used to see different events in the logs, examples below (that I saved):

[DHCP IP: 192.168.1.20] to MAC address a0:99:9b:0b:3f:5b, Wednesday, October 10, 2018 10:07:10, many of those used to show up

[DoS Attack: SYN/ACK Scan] from source: 80.91.172.35, port 443, Wednesday, October 10, 2018 10:04:53, also many of those used to be in the Logs

[UPnP set event: add_nat_rule] from source 192.168.1.20, Wednesday, October 10, 2018 11:15:53, quite many of those events was also seen

[remote login failure] from source 89.163.249.5, Monday, October 15, 2018 14:25:54

But now, I only see the remote login events. All of a sudden all other events disappeared. I remember last thing I did was to disable UPnP to get rid of the UPnP events but after that all other messages never came back!!

FURRYe38 · ‎2018-10-17

Possible the logging has changed in recent FW updates.

@Christian_R

ekhalil · ‎2018-10-28

@ekhalil wrote:

Directly after upgrade to 2.2.1.210 I used to see different events in the logs, examples below (that I saved):

[DHCP IP: 192.168.1.20] to MAC address a0:99:9b:0b:3f:5b, Wednesday, October 10, 2018 10:07:10, many of those used to show up

[DoS Attack: SYN/ACK Scan] from source: 80.91.172.35, port 443, Wednesday, October 10, 2018 10:04:53, also many of those used to be in the Logs

[UPnP set event: add_nat_rule] from source 192.168.1.20, Wednesday, October 10, 2018 11:15:53, quite many of those events was also seen

[remote login failure] from source 89.163.249.5, Monday, October 15, 2018 14:25:54

But now, I only see the remote login events. All of a sudden all other events disappeared. I remember last thing I did was to disable UPnP to get rid of the UPnP events but after that all other messages never came back!!

I made a factory reset and I now can see all events -including DHCP messages- again. 🙂

That the events were not shown in the logs seems like a bug in the software.

mjkamerick · ‎2019-03-05

I have the same issue of the logs recording only DHCP events and the occasional

time sync.

I guess I have to do a factory reset?

Can I reload a saved config file, or do I have to put back everything by hand?

Very annoying.

ekhalil · ‎2019-03-05

You should be able to make a backup, factory reset and then restore the backup. Please note that, unfortunately, after a while the Logs became bad again! That was on sw 2.2.1.210.
I noticed an improvement in logging in the latest software 2.3.0.32 so I would recommend go for that software. So far I can see all logging ok in this sw.

JoeM845 · ‎2019-03-05

I have had this running as an AP for a number of firmware versions (now 2.2.1.210) with all log options checked. I get little useful information. Entries are Initialized, Time Synchronized, email sent, login. I was hoping to see device associations and disassociations.

What is firmware 2.3.0.32? I see 2.2.1.210 as the latest.

CrimpOn · ‎2019-03-05

@JoeM845 wrote:

I have had this running as an AP for a number of firmware versions (now 2.2.1.210) with all log options checked. I get little useful information. Entries are Initialized, Time Synchronized, email sent, login. I was hoping to see device associations and disassociations.

What is firmware 2.3.0.32? I see 2.2.1.210 as the latest.

When the Orbi is running as an Access Point (AP), it does not perform any "router functions". i.e. it does not assign IP addresses to devices and does not perform any firewall functions. The items you see in the log are all "non-router" functions.
Netgear has been beta testing a firmware update and just recently posted it so interested users can download and install it manually. Sometime (no one knows when), Netgear may decide that no serious problems have developed from the wider deployment and will schedule Orbi's to update automatically. Or, they may decide, "Oops. This release isn't good enough to go world-wide with. Back to the beta process."

Generally the people who jump on the manual update are having issues with the current release and hope that the new firmware will solve them.

The new firmware is available on the Download site. Because it is a manual process, there is an "intermediate" firmware version, 2.2.0.212 which has to be applied before updating to 2.3.0.32.

FURRYe38 · ‎2019-03-06

Yes please try the saved configuration file after a factory reset.

@mjkamerick wrote:

I have the same issue of the logs recording only DHCP events and the occasional

time sync.

I guess I have to do a factory reset?

Can I reload a saved config file, or do I have to put back everything by hand?

Very annoying.

FURRYe38 · ‎2019-03-06

https://community.netgear.com/t5/Orbi/New-NetGear-Orbi-RBR50-RBS50-Firmware-Version-2-3-0-32-now/m-p...

@JoeM845 wrote:

I have had this running as an AP for a number of firmware versions (now 2.2.1.210) with all log options checked. I get little useful information. Entries are Initialized, Time Synchronized, email sent, login. I was hoping to see device associations and disassociations.

What is firmware 2.3.0.32? I see 2.2.1.210 as the latest.

JoeM845 · ‎2019-03-07

@FURRYe38 wrote:

https://community.netgear.com/t5/Orbi/New-NetGear-Orbi-RBR50-RBS50-Firmware-Version-2-3-0-32-now/m-p...

@@JoeM84 wrote:

What is firmware 2.3.0.32? I see 2.2.1.210 as the latest.

1) Thanks for the link. It says to install 2.2.1.212 first. Where is that?

2) Is there a discussion of 2.3.0.32 successes and problems somewhere?

3) I just reread the subject of this thread. Has there ever been specification of what activites can be logged?

ekhalil · ‎2019-03-08

@JoeM845 wrote:

1) Thanks for the link. It says to install 2.2.1.212 first. Where is that?

......

In the Netgear Support/Download page for the respective products:

@JoeM845 wrote:

..........

2) Is there a discussion of 2.3.0.32 successes and problems somewhere?

........

The Orbi community is full of feedback on this and other formware versions --> https://community.netgear.com/t5/Orbi/bd-p/Orbi

@JoeM845 wrote:

..........

3) I just reread the subject of this thread. Has there ever been specification of what activites can be logged?

The following are the activities that currently can be logged in Orbi:

JoeM845 · ‎2019-03-09

Thanks, @ekhalil.

1) The RBK50 support download page has been updated to show fw 2.3.0.32 very recently and now shows the needed links. The page previously suggested in this forum for 2.3.0.32 did not.

3) I have had the Wireless access option checked for months. I thought this might give me device connects and disconnects. There have been no entries logged. Do you know if this is something that was fixed in 2.3.0.32? Could Netgear have thought that APs would not involve wireless access?

ekhalil · ‎2019-03-09

@JoeM845 wrote:

..........

3) I have had the Wireless access option checked for months. I thought this might give me device connects and disconnects. There have been no entries logged. Do you know if this is something that was fixed in 2.3.0.32? Could Netgear have thought that APs would not involve wireless access?

Yes, I noticed much improvement in the Logs after upgrading to 2.3.0.32. So far so good.

I can see the DHCP assignemnts (device attaches). If you are in AP mode you will not see the DHCP assignements as it's not Orbi who does the DHCP functionality but the ISP router.

CrimpOn · ‎2019-03-09

@JoeM845 wrote:

3) I have had the Wireless access option checked for months. I thought this might give me device connects and disconnects. There have been no entries logged. Do you know if this is something that was fixed in 2.3.0.32? Could Netgear have thought that APs would not involve wireless access?

I have Wireless Access checked and also see nothing obvious in the log. There is not a check box for DHCP assignments, but they appear in the log. At first, I thought "Wireless Access" referred to DHCP., but the DHCP for wired devices appear in the log, too. My conclusion is that I have no idea what Netgear means by the term "Wireless Access".

ekhalil · ‎2019-03-09

@CrimpOn wrote
............

I have Wireless Access checked and also see nothing obvious in the log. There is not a check box for DHCP assignments, but they appear in the log. At first, I thought "Wireless Access" referred to DHCP., but the DHCP for wired devices appear in the log, too. My conclusion is that I have no idea what Netgear means by the term "Wireless Access".

I think that Wireless Access is just about the DHCP assignements for all devices. I think it's just called the wrong thing 🙂

Strange thing is that enabling and disabling "Wireless Access" changes a parameter called log_wire_access to 1 or 0. 😄 yes wired not wireless!