[xmohammad1]

Summary

Three bugs in how the node handles Xray's log output, found on a production node (v0.5.4, Xray 26.3.27, ~200k users). The same code is in v0.5.7 and dev.

1. "log": {"access": "none"} does not turn the access log off. Config.ToBytes() clears access and error before starting Xray, "none" included. Xray reads an empty value as "log to stdout", so every connection is still logged and streamed to the panel.
2. "none" is opened as a file. Core.Start passes the configured value to logger.SetLogFile, and openLogFile only skips "". With "access": "none", the node appended every access entry to /app/none in the container, with no rotation: 27.5 MB in the first 25 minutes on that node (~18 KB/s).
3. Traffic lines fail healthy starts. isStartupFailureLog looks for its keywords in every line Xray prints before its API answers, and clients reconnect during that window. Seen in production:
   • an access entry for a domain containing fatal (accepted tcp:…fatal…:443) returned failed to start xray: … accepted tcp:…, the node stopped Xray, and the node stayed down until the panel retried about 40 s later;
   • at log level info, [Info] … proxy/freedom: failed to open connection to … lines failed the start the same way on three nodes during one panel restart.

Changes

• logger: add DisabledLog = "none"; openLogFile treats it like an empty path.
• backend/xray/config.go: ToBytes keeps "none" for access/error. Real paths are still cleared.
• backend/xray/startup_diagnostics.go: skip access entries and [Info]/[Debug] lines. Access entries are matched by the new isAccessLogEntry, which also covers rejected entries: Xray writes two spaces after rejected when there is no destination, so the existing "rejected proxy/" check never matched a real line. Real failures still match: Failed to start: …, panics, Warning/Error lines.

Tests

• New: TestToBytesKeepsDisabledLogs, TestSetLogFileTreatsNoneAsDisabled, TestIsAccessLogEntry, and new cases in TestIsStartupFailureLog (the false positives above, plus real Failed to start: lines that must still fail).
• Set up as in run-tests.yml (WireGuard integration tests not run): TEST_INTEGRATION=true go test ./... -v -p 1 gives 276 passed, 0 failed with Xray v26.10.31, and the TestCoreStarted race run passes.
• Also run with Xray v26.3.27, the version on the affected nodes: same results as dev. The only failure, TestConvertLivePartsUsesTheInstalledXray, fails on dev too, because that Xray still accepts the VLESS outbound the test expects it to refuse.

Not changed

A config without a log section still gets "loglevel": "info" from GetLogFiles(). Xray's own default is warning with the access log off, so these nodes stream every connection plus all Info lines. That may be intended, so this PR leaves it alone.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1a605760-5b70-40c1-a4d1-1d7c7af9a165

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn