Change Details

Syslog messages from the kernel are being duplicated, both to local storage (/var/log/messages) and to remote syslog destinations. To replicate: - Create a new instance of Vyos nightly (noticed on versions from 1.5-rolling-202503030030 through 2025.04.01-0021-rolling) - Create a default deny firewall rule - tail -f /var/log/messages - Create traffic that hits the default deny firewall rule from a remote host (e.g. wget https://vyos-ip/) - Notice duplicate kernel log messages for denied traffic in /var/log/messages: ``` Apr 2 09:08:45 vyos kernel: [ 1986.329864] [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29171 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:45 vyos kernel: [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29171 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:46 vyos kernel: [ 1987.344107] [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29172 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:46 vyos kernel: [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29172 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:47 vyos kernel: [ 1988.357517] [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29173 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:47 vyos kernel: [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29173 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 ``` There should be 3 entries in the above /var/log/messages (one per second) - but instead there are 6 (each message is duplicated). The "ID=" field should be unique - but each ID can be seen in 2 messages. Note that the duplicate messages are malformed - including what looks like part of the time stamp at the beginning of the message entry.

Syslog messages from the kernel are being duplicated, both to local storage (/var/log/messages) and to remote syslog destinations. Steps to replicate / reproduce this issue: - Create a new instance of Vyos nightly (noticed on versions from 1.5-rolling-202503030030 through 2025.04.01-0021-rolling) - Create a default deny firewall rule - tail -f /var/log/messages - Create traffic that hits the default deny firewall rule from a remote host (e.g. wget https://vyos-ip/) - Notice duplicate kernel log messages for denied traffic in /var/log/messages: ``` Apr 2 09:08:45 vyos kernel: [ 1986.329864] [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29171 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:45 vyos kernel: [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29171 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:46 vyos kernel: [ 1987.344107] [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29172 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:46 vyos kernel: [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29172 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:47 vyos kernel: [ 1988.357517] [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29173 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:47 vyos kernel: [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29173 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 ``` There should be 3 entries in the above /var/log/messages (one per second) - but instead there are 6 (each message is duplicated). The "ID=" field should be unique - but each ID can be seen in 2 messages. Note that the duplicate messages are malformed - including what looks like part of the time stamp at the beginning of the message entry.

Syslog messages from the kernel are being duplicated, both to local storage (/var/log/messages) and to remote syslog destinations. TSteps to replicate:te / reproduce this issue: - Create a new instance of Vyos nightly (noticed on versions from 1.5-rolling-202503030030 through 2025.04.01-0021-rolling) - Create a default deny firewall rule - tail -f /var/log/messages - Create traffic that hits the default deny firewall rule from a remote host (e.g. wget https://vyos-ip/) - Notice duplicate kernel log messages for denied traffic in /var/log/messages: ``` Apr 2 09:08:45 vyos kernel: [ 1986.329864] [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29171 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:45 vyos kernel: [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29171 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:46 vyos kernel: [ 1987.344107] [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29172 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:46 vyos kernel: [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29172 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:47 vyos kernel: [ 1988.357517] [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29173 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 Apr 2 09:08:47 vyos kernel: [ipv4-NAM-WAN-LOCAL-4-default-D]IN=eth0 OUT= MAC=52:54:00:07:c0:f7:52:54:00:e4:f6:1c:08:00 SRC=192.168.122.1 DST=192.168.122.230 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=29173 DF PROTO=TCP SPT=58756 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 ``` There should be 3 entries in the above /var/log/messages (one per second) - but instead there are 6 (each message is duplicated). The "ID=" field should be unique - but each ID can be seen in 2 messages. Note that the duplicate messages are malformed - including what looks like part of the time stamp at the beginning of the message entry.