xrdp.log size is 21.32gb

[cesarleeds1979]

Hi guys

First of all, have to mention that i´m really no expert.

I own a Raspberry Pi 4 Model B, running Raspbian Linux 10 Buster

Using xrdp for a while, only to find out about this

/var/log/xrdp-sesman.log is 356,74kb
/var/log/xrdp.log is 21.32gb

That xrdp.log size makes no sense to me.

I have checked xrdp.ini and looks like this:

[Logging]
LogFile=xrdp.log
LogLevel=DEBUG
EnableSysLog=true
Sysloglevel=DEBUG
; LogLevel and SysLogLevel could be any of: core, error, warning, info or debug

Will setting CORE or ERROR result in a reduced xrdp.log?

I really don´t know if this means something, but sesman.ini Logging is set as DEBUG as well.

[matt335672]

That's some serious logging!

DEBUG logging can be useful for investigating problems, but it's not a good idea for production, and will always impact performance. Also, you don't need syslog enabled at the same time as the file log.

I'd suggest using INFO level, either to xrdp.log, or syslog (but not both). To turn off syslog, set EnableSysLog=false, and to turn off file logging, simply comment out the LogFile=xrdp.log line.

[cesarleeds1979]

Hey Matt, thanks for your prompt reply.

So is this what you are suggesting?

Option 1
[Logging]
LogFile=xrdp.log
LogLevel=INFO
EnableSysLog=false
Sysloglevel=DEBUG

Option 2
[Logging]
LogLevel=INFO
EnableSysLog=true
Sysloglevel=DEBUG

Would those changes reduce current xrdp.log file size once xrdp is restarted?

[matt335672]

The 2nd option would be:-

[Logging]
LogLevel=INFO
EnableSysLog=true
Sysloglevel=INFO

As for which to use, it depends on how you use your logs. If it's 'just in case', syslog may be a better option.

xrdp will append to an existing file, so:-

sudo systemctl stop xrdp
sudo cp /dev/null /var/log/xrdp.log
sudo systemctl start xrdp

Using cp /dev/null is preferable to simply removing the log, as it preserves file permissions.

BTW, sesman has its own logging controls in /etc/xrdp/sesman.ini which you might want to look at.

[cesarleeds]

I have done exactly that, option 2.

Now i have 2 xrdp.log files, one is empty, 0 kb, while the +20gb log is also there.

No changes happening on any of them.

Can i delete the +20gb one?

[matt335672]

I don't understand what you are saying @cesarleeds

You can't have two files with the same name in /var/log. Is there a typo somewhere?

[cesarleeds]

There was a typo, yeah, my bad :-)

I typed

sudo cp /dev/null /var/log/xdrp.log

Fixed it now.

xrdp.log is now 0kb

Thanks a lot!

Just for my understanding, where is xdrp log being stored now? Is it at /var/log/syslog?

[matt335672]

That's a classic typo! I still do it myself, now and then...

Yes - the log info is being sent to syslog, and from there, wherever is configured on your system. Try something like sudo grep -l xrdp /var/log/* to find it.

[cesarleeds]

Thanks, tried that command, got this

grep: /var/log/apt: Es un directorio (It´s a directory/folder, i guess)
/var/log/auth.log
/var/log/auth.log.1
/var/log/boot.log
grep: /var/log/cups: Es un directorio
/var/log/daemon.log
/var/log/daemon.log.1
/var/log/debug
/var/log/debug.1
grep: /var/log/deluged: Es un directorio
grep: /var/log/exim4: Es un directorio
grep: /var/log/hp: Es un directorio
grep: /var/log/lightdm: Es un directorio
grep: /var/log/private: Es un directorio
grep: /var/log/samba: Es un directorio
/var/log/syslog
/var/log/syslog.1
/var/log/xrdp-sesman.log

So if i ever have the look for xrdp log, where should i look into?

[matt335672]

It's probably /var/log/syslog, looking at that, but don't take my word for it - have a look.

I believe you're on a systemd-based system, so try something like sudo journalctl -S -1d | grep xrdp which should give you the xrdp logs for the last day.

[cesarleeds]

Yeap, that command did the trick.

Thanks a lot again.

Would this applied solution prevent this from happening again?

I mean, i just checked the old xrdp.log on notepad++ and it has 18.997.759 lines since 2021, funny that it stopped adding events on [20220306-04:14:06]

I just don´t want those events ending up on a different file/place.

This error showed up 1.895.319 times:

[ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied

Then, some other events:
[INFO] 5.734.322 times
[DEBUG] 11.368.042 times

On the other hand, i checked sesman.ini, and it looks like this:

[Logging]
LogFile=xrdp-sesman.log
LogLevel=DEBUG
EnableSyslog=1
SyslogLevel=DEBUG

And xrdp-sesman.log is barely 300 kb, since 2021 till today, 5252 lines.

I don´t understand where that huge size difference came from.

On https://manpages.ubuntu.com/manpages/focal/man5/xrdp.ini.5.html , it mentions this on Logging:

          DEBUG  or  4  - Log everything. If sesman is compiled in debug mode, this options will output many
          more low-level message, useful for developers

Maybe xrdp-sesman.ini logging settings had something to do with xrdp.log being that big?

[matt335672]

It shouldn't happen again.

In answer to your other questions and observations:

This error:

[ERROR] Cannot read private key file /etc/xrdp/key.pem: Permission denied

can be avoided by adding the xrdp user to the ssl-cert group. This is highly recommended as a security improvement. The reason it's not done out-of-the-box is down to Debian policy, and we can't fix it here. More info at #2297 and https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860890

The xrdp executable is responsible for exporting an X11 session over RDP. The xrdp-sesman executable manages sessions. xrdp is involved in every keyboard event, every mouse event, and every screen update. If you use DEBUG logging with xrdp you get a lot of logging! xrdp-sesman is not used a lot by comparison. If you start a session at the start of a day, and shut it down at the end of the day, xrdp-sesman will generate a handful of messages at most.