Issue Site log files unreadable after installing Flex firewall manager

[djhoets]

Server operating system version

Microsoft Windows Server 2022

Plesk version and microupdate number

Plesk Obsidian Web Admin Edition Version 18.0.67

Last week I installed the Flex firewall manager. Ever since then the log files of my web sites have become unreadable. For example, the IP address of the source is not extracted/shown. All my IIS access entries now look like this:


Already ran the repair tool and running:
Plesk Obsidian Web Admin Edition
Version 18.0.67

Any suggestions would be greatly appreciated.

 

[Sebahat.hadzhi]

Hello, @djhoets I am unable to reproduce the issue on a test environment. Have you added any custom rules to the Firewall? Do you have another firewall enabled that might be causing a conflict? Is there any effect if you zoom out the page in the browser?

 

[djhoets]

Hello @Sebahat.hadzhi, thanks for getting back to me. As for your questions:

1. Custom rules: yes, I do have some rules to block specific IP addresses from accessing specific ports. But I have had these for a long time and they ever caused log file problems.
2. Firewall: only the firewall that comes with plesk and windows.
3. Zooming out does not make a difference. And if I look at the the log files on my server, all the information is there. It just seems like the mapping is wrong.

The only other thing that was changed recently was switching the modsecurity from OWASP to Atomic standard and back to OWASP again. This because when running the advisor it stated "ModSecurity is switched off". FYI (seperate issue), when I select the [Turn on] button on the advisor page it starts installing and says it has turned on. However, when you run the advisor again you get the same message "ModSecurity is switched off".

 

[Sebahat.hadzhi]

This because when running the advisor it stated "ModSecurity is switched off". FYI (seperate issue), when I select the [Turn on] button on the advisor page it starts installing and says it has turned on. However, when you run the advisor again you get the same message "ModSecurity is switched off".

This is a known issue identified with bug ID EXTADVISOR-940. Our team will introduce a fix for it in one of the upcoming releases. We would like to apologize for the misleading information and any possible confusion caused.

As for the issue with the logs, please try disabling your custom modules and double-check if that would made any difference.

 

[djhoets]

I already disabled them. It makes no difference.

 

[Sebahat.hadzhi]

I see. Unfortunately, I don't have any other suggestions what might be causing the issue. I would suggest opening a ticket to Plesk support for an investigation of the issue on your server. To sign-in to support and open a ticket go to

https://support.plesk.com

If you got your license from a reseller, your reseller should provide support for you. If the reseller does not provide support, here is an alternative to get support directly from Plesk

https://support.plesk.com/hc/en-us/articles/12388090147095-How-to-get-support-directly-from-Plesk

 

[djhoets]

OK, will do. Thanks for the effort.

 

[djhoets]

Update:

For anyone stumbling upon this thread, I today discovered that since installing the extension all log files have "_x" added to their name (for "extended" perhaps). For example "e_ux250123.log" has become "e_ux250123_x.log". Also two new columns have appeared within the log filea: "x-ff" and "cf-cip". Not sure, but I have a suspicion that these two extra columns may throw the mapping off.

 

[djhoets]

Further update: inspecting logging settings in the Internet Information Services (IIS) Manager it turned out "x-ff" and "cf-cip" were added to the log files as custom fields at the end of each log line. I removed these fields and now the mapping is correct again and my log in Plesk looks like it used to. The log files are also back to what they used to be (i.e. without the "_x"). No clue why these were added though.

 

[Sebahat.hadzhi]

@djhoets , the behavior was indeed recognized as a bug identified with ID PPPM-14822. However, Flex Firewall Manager extension does not cause the issue. The same occurs due to the presence of custom fields in IIS logs for a domain. Plesk Log Viewer under domains shows incorrect/mixed information if custom fields in IIS are configured. Thank you for bringing that to our attention. Our team will introduce a fix for it in the upcoming releases. You can observe the change log here.