Access log truncating

[brazhenko]

I am using xray 24.9.30 as a dependency of 3x-ui panel. I am experiencing a problem with access.log truncated approximately every hour (at HH:14). I.e. it contiguously contains entire log, but at some point it resets and starts from the clear file.

It seems to be some stupid misconfiguration, but I don't know how to debug that. More info in screenshot (daemon is started more then a day).

[marchuk-vlad]

Have same ptroblem. @brazhenko Have you managed to deal with this problem?

[chendilinn]

Hello, @marchuk-vlad @brazhenko Have you managed to resolve the issue with access.log being truncated approximately every hour (at HH:14)? If so, could you share how you fixed it? I'm facing the same problem in my setup with 3x-ui and Xray.

[chendilinn]

Hello @brazhenko @marchuk-vlad , I've also been looking into the issue of access logs being cleared periodically and have done some analysis of the source code. Here are my findings, which should answer the question.

This behavior is indeed by design and is related to a scheduled task within the application.

1. Where is the log clearing logic?

The logic for clearing the access log is part of a scheduled job found in web/job/check_client_ip_job.go. This job runs every 10 seconds, but it only clears the log if more than an hour (3600 seconds) has passed since the last time it was cleared.

The specific function that performs the clearing is clearAccessLog() within the same file. Before clearing, it backs up the current access log to a persistent log file.

2. The Code That Clears the Log

The log file is cleared using os.Truncate(accessLogPath, 0), which corresponds to the truncate syscall observed.

// web/job/check_client_ip_job.go

func (j *CheckClientIpJob) clearAccessLog() {
    // ... code to back up the log ...

    // This line truncates the access log file, effectively clearing it.
    err = os.Truncate(accessLogPath, 0)
    j.checkError(err)
    j.lastClear = time.Now().Unix()
}

3. How is the persistent log file path configured?

The path for the persistent log file (3xipl-ap.log) is determined by the GetLogFolder() function in config/config.go.

• It first checks for an environment variable named XUI_LOG_FOLDER.
• If this variable is not set, it defaults to /var/log.

So, the final path is either $XUI_LOG_FOLDER/3xipl-ap.log or /var/log/3xipl-ap.log. You can change this location by setting the XUI_LOG_FOLDER environment variable before running the application.

// config/config.go
func GetLogFolder() string {
	logFolderPath := os.Getenv("XUI_LOG_FOLDER")
	if logFolderPath == "" {
		logFolderPath = "/var/log"
	}
	return logFolderPath
}

// xray/process.go
func GetAccessPersistentLogPath() string {
	return config.GetLogFolder() + "/3xipl-ap.log"
}

4. Why is it designed this way? (Speculation)

This design appears to be a log rotation and management strategy. The primary purposes are likely:

• Preventing Disk Space Issues: It stops the main access log file from growing indefinitely, which could consume a large amount of disk space over time.
• Performance: Regularly clearing the log file that is actively being written to can maintain performance.
• Integration with Security Tools: The job is named CheckClientIpJob, and the logic seems tied to IP limiting features, possibly for integration with tools like fail2ban. By periodically processing and then clearing the log, the system can efficiently manage IP-based access rules without having to parse-through an enormous log file on each run.

Currently, the one-hour interval is hardcoded and cannot be changed from the panel UI. To modify it, you would need to change the 3600 value in the source code and recompile the project.

I hope this detailed explanation helps others who have the same question!

[brazhenko]

@chendilinn @marchuk-vlad

I got the same results as yours, but had no time to leave it here. Marked as answer.

All I can suggest which also works for me is to configure custom logrotate.

cat /etc/logrotate.d/3xui 

/var/log/3xipl-ap.prev.log {
    daily
    rotate 30
    compress
    missingok
    notifempty
    dateext
    dateformat -%Y-%m-%d
}