Syslog export appears enabled but stops forwarding silently

[DavidePrincipi]

Steps to reproduce

• Enable Syslog export on a NS8 node with syslog-forwarder.service running
• Let /home/loki1/.config/state/syslog_last_timestamp fall behind the current time by more than Loki's maximum queryable window (> 31 days)
• Observe that logcli is invoked by the forwarder script with capture_output=True, but its return code and stderr are not checked
• Check systemctl status syslog-forwarder.service and the NS8 GUI Syslog export panel

Expected behavior

When the underlying logcli query fails (e.g. because the requested time range exceeds Loki's configured limit), the forwarder should detect the failure (non-zero return code / stderr output) and either:

• recover automatically, e.g. by clamping/resetting syslog_last_timestamp to a valid window, and/or
• surface the failure clearly, so syslog-forwarder.service and the GUI Syslog export status stop reporting "active/enabled" while no logs are actually being forwarded

Actual behavior

syslog_last_timestamp was stuck at an old date, causing every subsequent logcli query to fail with:

the query time range exceeds the limit (query length: 1902h50m46.593s, limit: 30d1h)

Despite this, syslog-forwarder.service kept reporting active (running), and the NS8 GUI still showed Syslog export as enabled — with no logs actually reaching the syslog collector for an extended period. The failure was silent because the script does not check logcli's return code nor handle stderr.

Workaround

Manually stopping the service, updating syslog_last_timestamp to a recent value, and restarting the forwarder restored log delivery to the collector.

Components

ns8-core 3.21.1
ns8-loki 1.5.1

See also

• https://mattermost.nethesis.it/nethesis/pl/r5eorrzeppyh5rbmxyueopz4ea