Re: [pve-devel] [PATCH proxmox-firewall] firewall: show full error if rule apply fails

[Stefan Hanreich <s.hanreich@proxmox.com>]

On 6/30/25 13:23, Christoph Heiss wrote:
> Currently, this will only log something like
> 
>   error updating firewall rules: cannot execute nftables commands
> 
> which, by itself, is pretty unhelpful. `anyhow` errors have context, so
> show that too.

How much additional lines in the log would that be? Since the daemon
runs every 5s this could grow large quite quickly. I already made some
effort of improving the debug experience by introducing new subcommands
[1], similar to pve-firewall. So potentially that is sufficient?
Otherwise we could also make this dependent on the log level?

[1]
https://lore.proxmox.com/pve-devel/20250527135800.190084-3-s.hanreich@proxmox.com/

> Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
> ---
>  proxmox-firewall/src/bin/proxmox-firewall.rs | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/proxmox-firewall/src/bin/proxmox-firewall.rs b/proxmox-firewall/src/bin/proxmox-firewall.rs
> index 4732e51..5cd0c70 100644
> --- a/proxmox-firewall/src/bin/proxmox-firewall.rs
> +++ b/proxmox-firewall/src/bin/proxmox-firewall.rs
> @@ -101,7 +101,7 @@ fn main() -> Result<(), std::io::Error> {
>          let start = Instant::now();
>  
>          if let Err(error) = handle_firewall() {
> -            log::error!("error updating firewall rules: {error}");
> +            log::error!("error updating firewall rules: {error:#}");
>          }
>  
>          let duration = start.elapsed();



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel