<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi there Jana,</p>
<div class="moz-cite-prefix">On 2/24/25 16:25, Jana Babovakova
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:92e86863-ae59-4bfd-ab61-69b6c8a9a85b@nic.cz">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
Hi Nigel.<br>
<br>
I suspect this is due to BIRD 3 working as multi-thread. In the
migration guide there is a note about that:<br>
<br>
"
<h2 data-sourcepos="21:1-21:10" dir="auto">Logging</h2>
<p data-sourcepos="23:1-26:45" dir="auto">Log files have a
slightly different format, indicating by <code
data-sourcepos="23:60-23:65">[abcd]</code> the actual thread
logging the message. This enables the user to better comprehend
what's actually going on between interleaved messages from
different threads, especially when detailed route tracing is on.</p>
<p data-sourcepos="28:1-30:43" dir="auto">There is also a new
logging option, a fixed-size circular logfile. This is handy if
you need to switch on detailed tracing but you don't want to
overfill your disk. Also this option is by far the fastest one.</p>
"<br>
</blockquote>
<p>I did see this in the migration guide, but even a single "print"
in a filter seems to loop continuously to the log file very many
times per second.</p>
<p>For comparison, Bird v2 had around 200 log lines after a few
minutes, Bird v3 before I killed it after 30s or so was at 1.17M
lines.<br>
</p>
<p>Is this intended behavior with v3? (it pretty much means I cannot
log in my filters anymore). I just want to confirm so I can remove
the print messages.<br>
</p>
<p>Kind Regards<br>
Nigel<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:92e86863-ae59-4bfd-ab61-69b6c8a9a85b@nic.cz"> <br>
I hope this helps.<br>
Kind regards, <br>
Jana<br>
<br>
<pre class="moz-signature" cols="72">Jana Babovakova | BIRD Tech Support | CZ.NIC, z.s.p.o.</pre>
<div class="moz-cite-prefix">On 24. 02. 25 16:54, Nigel Kukard via
Bird-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:928a90b3-a8ea-45b7-9ae0-c0c7de2fa665@LBSD.net">Hi
there, <br>
<br>
I'm wondering if anyone has seen excessive filter logging with
3.0.0/3.0.1? <br>
<br>
Comparing log output from tests done on v2 vs v3, I'm seeing 2G+
log files generated in 30s on v3, when in v2 the log files were
only a few hundred Kb in size at most after some time. <br>
<br>
I have router R1 and R2 connected via BGP. I have a couple of
filters which log if a prefix has been filtered or accepted,
I've included my log configuration and filter below. <br>
<br>
Here is the log config I'm using... <br>
<br>
<br>
log "/var/log/bird.log" { info, warning, fatal }; <br>
debug protocols { states, routes, filters, interfaces, events };
<br>
timeformat base iso long; <br>
timeformat log iso long; <br>
timeformat protocol iso long; <br>
timeformat route iso long; <br>
<br>
<br>
Here is the test filter I created to test... <br>
<br>
define DEFAULT_ROUTE_V4 = 0.0.0.0/0; <br>
define DEFAULT_ROUTE_V6 = ::/0; <br>
<br>
function is_default(string filter_name) -> bool { <br>
if ((net.type = NET_IP4 && net = DEFAULT_ROUTE_V4)
|| (net.type = NET_IP6 && net = DEFAULT_ROUTE_V6)) then
<br>
return true; <br>
return false; <br>
} <br>
<br>
function bgp_accept_bgp(string filter_name) -> bool { <br>
if (is_default()) then return false; <br>
print filter_name, " [bgp_accept_bgp] Accepting BGP route ",
net, " from ", proto; <br>
accept; <br>
} <br>
<br>
filter f_bgp_master_export <br>
string filter_name; <br>
{ <br>
filter_name = "f_bgp_master_export"; <br>
bgp_accept_bgp(filter_name); <br>
reject; <br>
}; <br>
<br>
<br>
Here is the odd behavior I"m observing in v3... <br>
<br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.111.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.112.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.113.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.201.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.131.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.132.0.0/24 from
bgp4_AS65000_r1 <br>
<br>
repeating very many times per second... <br>
<br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.111.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.112.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.113.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.201.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.131.0.0/24 from
bgp4_AS65000_r1 <br>
2025-02-24 15:21:04 [0002] <INFO> f_bgp_master_export
[bgp_accept_bgp] Accepting BGP route 100.132.0.0/24 from
bgp4_AS65000_r1 <br>
<br>
In about 30s my log file grew to 2.1GB before I stopped the
process. <br>
<br>
Perhaps I'm missing something in the migration guide? any help
would be greatly appreciated. <br>
<br>
Kind Regards <br>
Nigel <br>
<br>
<br>
</blockquote>
<br>
</blockquote>
</body>
</html>