Menu
What's new
By:
Filters Better Search

Any way to diagnose further these dnsmasq restart events?

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

saison2023

saison2023

Regular Contributor
Hello,

Last week, I had a trouble with dnsmasq that was restarting so often that I was unable to even have Internet access because I wasn't able to have DNS resolution.
I disabled AdGuardHome because I thought it was related (a lot of AdGuardHome's event was registered when dnsmasq was crashing).

Still with AdGuardHome disabled, I had the same behavior happened yesterday, but even worst because some devices were unable to receive IP address from DHCP.

Suspecting a fault in my setup, I opted to erase everything:
  • Format hard drive (in NTFS) and unplugged it
  • Reboot the router
  • Factory reset the router using Web GUI
  • Reconfigure from scratch
After some times (doing speed test, video streaming and rebooting the router few times), I went back to amtm and activated only these scripts:
  • Skynet
  • FlexQoS
  • scMerlin
  • (I didn't install AdGuardHome because I thought it was th culprit)
Unfortunately, I was disappointed this morning to find that the dnsmasq errors are still present (refer to the latest from this morning below).

Can someone guide me to go deeper and try to find the reason?

Thanks

Jun 18 07:20:43 hostapd: eth6: STA 88:57:1d:1b:6d:36 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: eth7: STA 0c:43:f9:a2:01:9e WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl0.1: STA 80:7d:3a:64:43:50 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl0.1: STA 50:14:79:76:bd:a7 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: eth7: STA 76:a8:34:97:a9:a6 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl1.1: STA 28:73:f6:0f:f9:90 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl1.1: STA 44:3d:54:c1:97:23 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: wl0.1: STA 50:14:79:74:ac:ae WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: eth7: STA b2:2f:5d:b1:ea:f0 WPA: group key handshake completed (RSN)
Jun 18 07:20:43 hostapd: eth7: STA 6e:bf:55:39:7b:cf WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: eth7: STA 2a:ca:97:8f:77:4c WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: eth7: STA 3a:72:e4:3c:9d:c9 WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: eth7: STA 2a:19:e2:76:b6:11 WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: eth7: STA ca:5f:c3:8c:94:65 WPA: group key handshake completed (RSN)
Jun 18 07:20:44 hostapd: wl0.1: STA fc:45:c3:ba:59:10 WPA: group key handshake completed (RSN)

Jun 18 07:25:06 rc_service: service 6788:notify_rc restart_dnsmasq
Jun 18 07:25:06 custom_script: Running /jffs/scripts/service-event (args: restart dnsmasq)
Jun 18 07:25:06 dnsmasq[24142]: exiting on receipt of SIGTERM
Jun 18 07:25:06 custom_config: Appending content of /jffs/configs/dnsmasq.conf.add.
Jun 18 07:25:06 dnsmasq[6842]: started, version 2.90 cachesize 1500
Jun 18 07:25:06 dnsmasq[6842]: DNSSEC validation enabled
Jun 18 07:25:06 dnsmasq[6842]: configured with trust anchor for <root> keytag 20326
Jun 18 07:25:06 dnsmasq[6842]: asynchronous logging enabled, queue limit is 5 messages
Jun 18 07:25:06 dnsmasq-dhcp[6842]: DHCP, IP range 192.168.102.2 -- 192.168.102.254, lease time 1d
Jun 18 07:25:06 dnsmasq-dhcp[6842]: DHCP, IP range 192.168.101.2 -- 192.168.101.254, lease time 1d
Jun 18 07:25:06 dnsmasq-dhcp[6842]: DHCP, IP range 172.16.1.100 -- 172.16.1.110, lease time 1d
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for use-application-dns.net
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for lan.local
Jun 18 07:25:06 dnsmasq[6842]: read /etc/hosts - 84 names
Jun 18 07:25:06 custom_script: Running /jffs/scripts/service-event-end (args: restart dnsmasq)
Jun 18 07:25:06 dnsmasq[6842]: using nameserver 9.9.9.9#53
Jun 18 07:25:06 dnsmasq[6842]: using nameserver 149.112.112.112#53
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for use-application-dns.net
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for lan.local
Jun 18 07:25:06 dnsmasq[6842]: using nameserver 9.9.9.9#53
Jun 18 07:25:06 dnsmasq[6842]: using nameserver 149.112.112.112#53
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for mask.icloud.com
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for use-application-dns.net
Jun 18 07:25:06 dnsmasq[6842]: using only locally-known addresses for lan.local

Jun 18 07:46:40 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 3A:72:E4:3C:9D:C9, status: 0, reason: Disassociated due to inactivity (4), rssi:-88
Jun 18 07:46:40 hostapd: eth7: STA 3a:72:e4:3c:9d:c9 IEEE 802.11: disassociated
Jun 18 07:46:40 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 3A:72:E4:3C:9D:C9, status: 0, reason: Previous authentication no longer valid (2), rssi:-88
Jun 18 07:46:40 hostapd: eth7: STA 3a:72:e4:3c:9d:c9 IEEE 802.11: disassociated
Jun 18 07:46:41 wlceventd: wlceventd_proc_event(662): eth7: Disassoc 3A:72:E4:3C:9D:C9, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0
Jun 18 07:46:41 hostapd: eth7: STA 3a:72:e4:3c:9d:c9 IEEE 802.11: disassociated
Jun 18 07:53:37 wlceventd: wlceventd_proc_event(685): eth6: Auth 76:A8:34:97:A9:A6, status: Successful (0), rssi:0
Jun 18 07:53:37 hostapd: eth6: STA 76:a8:34:97:a9:a6 IEEE 802.11: associated
Jun 18 07:53:37 wlceventd: wlceventd_proc_event(695): eth6: ReAssoc 76:A8:34:97:A9:A6, status: Successful (0), rssi:-63
Jun 18 07:53:37 hostapd: eth6: STA 76:a8:34:97:a9:a6 RADIUS: starting accounting session B10E21AF12513244
Jun 18 07:53:37 hostapd: eth6: STA 76:a8:34:97:a9:a6 WPA: pairwise key handshake completed (RSN)
Jun 18 07:53:46 bsd: bsd: Sending act Frame to 76:a8:34:97:a9:a6 with transition target eth6 ssid 7c:10:c9:b4:cb:c0
Jun 18 07:53:47 bsd: bsd: STA:76:a8:34:97:a9:a6 no response
Jun 18 07:53:47 bsd: bsd: Sending act Frame to 76:a8:34:97:a9:a6 with transition target eth6 ssid 7c:10:c9:b4:cb:c0
Jun 18 07:53:48 bsd: bsd: STA:76:a8:34:97:a9:a6 no response
Jun 18 07:53:55 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 76:A8:34:97:A9:A6, status: 0, reason: Previous authentication no longer valid (2), rssi:-84
Jun 18 07:53:55 hostapd: eth7: STA 76:a8:34:97:a9:a6 IEEE 802.11: disassociated
Jun 18 07:53:55 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 76:A8:34:97:A9:A6, status: 0, reason: Disassociated due to inactivity (4), rssi:-84
Jun 18 07:53:55 hostapd: eth7: STA 76:a8:34:97:a9:a6 IEEE 802.11: disassociated
Jun 18 07:53:55 hostapd: eth7: STA 76:a8:34:97:a9:a6 IEEE 802.11: disassociated
Jun 18 07:53:55 wlceventd: wlceventd_proc_event(645): eth7: Deauth_ind 76:A8:34:97:A9:A6, status: 0, reason: Previous authentication no longer valid (2), rssi:-84
Jun 18 07:53:56 wlceventd: wlceventd_proc_event(662): eth7: Disassoc 76:A8:34:97:A9:A6, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0
Jun 18 07:53:56 hostapd: eth7: STA 76:a8:34:97:a9:a6 IEEE 802.11: disassociated
 
Skynet restarts dnsmasq when updating the malware lists and/or refreshing the whitelists. I'm guessing Skynet updated at 07:25 AM for you.
 
dave14305 said:
Skynet restarts dnsmasq when updating the malware lists and/or refreshing the whitelists. I'm guessing Skynet updated at 07:25 AM for you.
Click to expand...
Good point.

I will check if this occurs again tomorrow morning.

Thank you for the prompt response.
 
@dave14305 This was a really good call and I was hoping this was so simple, yet I experienced another dnsmasq restart at 6:25 PM yesterday, and there was no restart at 7:25 AM today (which seemed to be related to Skynet's update).
There are no entries in the log that provide any clues before or after the event.
The "Default message log level" is set to "notice". I will give a try to change it to see if it makes a difference.
Any advice on this matter would be greatly appreciated.
Thank you.

Jun 18 18:25:05 custom_script: Running /jffs/scripts/service-event (args: restart dnsmasq)
Jun 18 18:25:05 dnsmasq[24732]: exiting on receipt of SIGTERM
Jun 18 18:25:05 custom_config: Appending content of /jffs/configs/dnsmasq.conf.add.
Jun 18 18:25:05 dnsmasq[14943]: started, version 2.90 cachesize 1500
Jun 18 18:25:05 dnsmasq[14943]: DNSSEC validation enabled
Jun 18 18:25:05 dnsmasq[14943]: configured with trust anchor for <root> keytag 20326
Jun 18 18:25:05 dnsmasq[14943]: asynchronous logging enabled, queue limit is 5 messages
Jun 18 18:25:05 dnsmasq-dhcp[14943]: DHCP, IP range 192.168.102.2 -- 192.168.102.254, lease time 1d
Jun 18 18:25:05 dnsmasq-dhcp[14943]: DHCP, IP range 192.168.101.2 -- 192.168.101.254, lease time 1d
Jun 18 18:25:05 dnsmasq-dhcp[14943]: DHCP, IP range 172.16.1.100 -- 172.16.1.110, lease time 1d
Jun 18 18:25:05 custom_script: Running /jffs/scripts/service-event-end (args: restart dnsmasq)
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for use-application-dns.net
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for lan.local
Jun 18 18:25:05 dnsmasq[14943]: read /etc/hosts - 84 names
Jun 18 18:25:05 dnsmasq[14943]: using nameserver 9.9.9.9#53
Jun 18 18:25:05 dnsmasq[14943]: using nameserver 149.112.112.112#53
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for use-application-dns.net
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for lan.local
Jun 18 18:25:05 dnsmasq[14943]: using nameserver 9.9.9.9#53
Jun 18 18:25:05 dnsmasq[14943]: using nameserver 149.112.112.112#53
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask-h2.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for mask.icloud.com
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for _dns.resolver.arpa
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for use-application-dns.net
Jun 18 18:25:05 dnsmasq[14943]: using only locally-known addresses for lan.local
 
dave14305 said:
Look in cron to see what runs on a schedule.
Code: 
cru l
Click to expand...
Here is my cron list:
  • 25 18 * * * sh /jffs/scripts/firewall banmalware #Skynet_banmalware#
    • Daily at 18:25
  • 10 1 * * Mon sh /jffs/scripts/firewall update #Skynet_autoupdate#
    • At 01:10 each Monday
  • 0 * * * * sh /jffs/scripts/firewall save #Skynet_save#
    • Each hour
  • 52 */12 * * * sh /jffs/scripts/firewall debug genstats #Skynet_genstats#
    • at 12:52:00 and 00:52:00
Yesterday evening at 6:25 PM is indeed Skynet.
I will continue to monitor, keeping these schedules in mind.

Thanks
 
Last edited:
You must log in or register to reply here.

Similar threads

Tyrfing
Asus RT-AX88U Stuck on Merlin Firmware 388.1
Replies
9
Views
1K
Tyrfing
Tyrfing
S
HELP! Asus Ax11000 (Merlin 388.2)- Slow 5ghz Speeds when Enabling Guest 2.4ghz Wifi
Replies
3
Views
2K
drinkingbird
drinkingbird
A
AX86U after fw upgrade: The Country Code is not exist! Please enter Country Code.
Replies
7
Views
2K
fennng
F
A
RP-AC55, as media bridge, blocks DNS (and possibly http) queries to local DNS server connected to it - iptables, dnsmasq
Replies
0
Views
1K
Annetiteg
A
A
N66U Failing? rebooting itself
Replies
8
Views
4K
AlwaysLearning
A
Similar threads
Thread starter Title Forum Replies Date
el_pedr0 Please help me diagnose knotty routing problem Asuswrt-Merlin 4
S Solved New ISP - WAN Setup - Will not work with custom WAN DNS - dnsmasq.conf Asuswrt-Merlin 1
B dnsmasq: failed to create listening socket for 192.168.1.1: Address already in use Asuswrt-Merlin 7
Siff Setting dnsmasq on Asuswrt-Merlin Asuswrt-Merlin 8
V Import lease list to dnsmasq.conf.add Asuswrt-Merlin 5
V dnsmasq.config.add without ip? Asuswrt-Merlin 2
XxUnkn0wnxX Proper dnsmasq config for local resolver? Asuswrt-Merlin 3
P In dnsmasq, how do I stop overriding an address if the server goes down? Asuswrt-Merlin 1
P dnsmasq custom domain doesn't work on windows 10 Asuswrt-Merlin 1
C How to make dnsmasq startup wait for USB mount? Asuswrt-Merlin 4

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 670 (members: 12, guests: 658)
Top