View Single Post
Old 05-20-2012, 10:49 AM   #269
morantis
Zealot
morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.morantis ought to be getting tired of karma fortunes by now.
 
Posts: 125
Karma: 769546
Join Date: May 2012
Device: none
Quote:
Originally Posted by JoeD View Post
One quick point before discussing the screenshots. Whilst you're discussing non-consumer routers, the others in this post are talking about consumer routers. That is likely why there's such a disagreement about the logging capabilities as the two vary widely.

Looking at the screenshot you provide, that looks like an incoming access log, not a access log for every website you've ever visited or connections made to internet computers? I could be wrong on that, and if so have a couple of other last questions which will likely settle it, but I'll leave those for now

If that is the case, then yes, it will be very reasonable for a < 100KB file to include years worth of data since unless you're running self-hosted services, the only odd incoming connections you'd expect to see would be perhaps VNC/other remote access to your internal computers, or SSH'in in from a remote computer. (excluding UPNP) You may only access it once in a blue moon and other than the date/time of access most of the entry will be duplicated. Even without compression the size would be low.

When you vi access.log or the log.1 (which might be a rotated version of access.log), see if you can find the IP address 67.205.70.12 logged as been accessed by you today.


edit: also for what it's worth, the logs don't appear to be compressed in any way at least going by the lack of file extensions, it's possible vi could be decompressing on the fly, easiest way to tell is run

file /var/log/access.log
file /var/log/log.1

if it reports compressed or not.

If it's not then that would limit how many entries they could contain whilst remaining under 100KB. At a guess I'd say about 70 bytes per log line, in a 97KB file would around 1400 lines of logs. That would be less than 4 site visits per day for a single year, if the logs really did hold entries going back 5 years you're looking at under one web page visit per day.

To determine the number of entries, you could open log.1 (and access.log) in vi then run

:$

to skip to the end and

:set nu

to show line numbers.

or if the router has wc

wc -l /var/log/access.log
wc -l /var/log/log.1

that'll give you the number of lines in both.

One final question, if you do find the IP address I mentioned, look at what the most recent date/time for it and the oldest date/time is in both access.log and log.1

It seems likely to me though that the router is logging inbound connections to your machines, i.e "lan access from remote" rather than outbound connections to sites you visit, which is what we've been discussing in this thread with regards to the original IP identifying a person topic.
If you would have read my post, you would see that the router I accessed was a common Linksys consumer router. And, if you would have read the screenshot you would see the find command was used to determine the file size outside of any other program.
morantis is offline   Reply With Quote