Diagnose missing IPDB log activity

Quiet cPFence v4+ logs do not necessarily mean protection is off. There may be no new matching incidents.

Check the selected server's protection switches before investigating quiet logs. Identifying values are hidden. Select the image for full size; use browser Back to return.

1. Check IPDB Protection and DDoS Protection in IPDB Firewall & IP Tools → Settings.
2. As root, run cpfence --monitor-ipdb-blocks and compare its output with IPDB summary.
3. Check system logging:

systemctl status rsyslog --no-pager
journalctl -u rsyslog -n 20 --no-pager
ls -lah /var/log/syslog
systemctl list-units --failed

4. If rsyslog is inactive, resolve the logged error. An administrator can start the configured service with systemctl start rsyslog after checking why it stopped.
5. If IPDB itself reports a failure, review that error before deliberately using cpfence --restart-ipdb.

Protection can remain active without a logging service

Missing log entries do not prove traffic was allowed. Compare current policy and service state; no fixed number of blocks per minute is expected.

Avoid creating, truncating or changing ownership of system logs blindly. If logging remains unavailable, ask your server administrator or support to check the system logging configuration, preserving the reported errors.