It seems the cron task to update geoip weekly is not completing:
cat /tmp/geoip-update.log Downloading latest DB-IP database... Extracting database... Error: GeoIP failed to update firewall and/or policy
It appears to succeed when running update geoip from op-mode: at least the modified time of /run/nftables-geoip.conf is updated.
Some troubleshooting indicates that the default PATH used by scripts in /etc/cron.d is /usr/bin:/bin, while nft is in /usr/sbin
which nft /usr/sbin/nft
It seems there are a few possibilities for resolving, while keeping the vyos-geoip script in /etc/cron.d:
- Use the full path in the call to nft that the cron script uses.
result = run(f'/usr/sbin/nft --file {nftables_geoip_conf}')- Set PATH in vyos-geoip to include /usr/sbin
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin 30 4 * * 1 root sg vyattacfg "/usr/libexec/vyos/geoip-update.py" >/tmp/geoip-update.log 2>&1
- Perhaps others...?
Using either option 1 or 2 succeeds in my testing:
cat /tmp/geoip-update.log Downloading latest DB-IP database... Extracting database...
What comments or input might there be?