Asus RT-AC66U Rebooting Every 4 Hours

[Scypher]

Hi. I have the RT-AC66U, running Asuswrt-Merlin 380.68_4.

Its connected to a Cisco DPC3008 Cable Modem. Comcast. 250/25 connection.

Problem:
Router reboots/crashes once every 4 hours, 1-3 minutes after the hour, like clockwork. Graph, starting from when I started syslogging to remote server:

Background:
This started yesterday, after updating the router from its stock firmware (I don't remember what it was, but it was at least a couple years old.) to asuswrt-merlin 380. Nothing else changed. The only settings I've changed from stock merlin are:


Pre-noticing the problem:
enable ssh
iptables rule for port mirroring

post noticing the problem (no change):
disabled port mirroring
syslog log everything
syslog send to remote syslog server
DHCP query frequency from aggressive to normal

Logs:
Dec 4 08:01:07 192.168.1.1 Dec 4 16:00:39 kernel: DPT=161 LEN=68
Dec 4 08:01:10 192.168.1.1 Dec 4 16:01:07 kernel: 7 ID=14924 PROTO=UDP <1>SPT=63923 DPT=8888 LEN=9
Dec 4 08:02:04 192.168.1.1 Dec 4 16:02:04 dnsmasq-dhcp[296]: DHCPACK(br0) 192.168.1.139 34:f6:4b:75:cd:17 DESKTOP-ET6O021
Dec 4 08:02:04 192.168.1.1 Dec 4 16:02:04 dnsmasq-dhcp[296]: DHCPREQUEST(br0) 192.168.1.139 34:f6:4b:75:cd:17
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: port 1(vlan1) entering forwarding state
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: topology change detected, propagating
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: port 2(eth1) entering forwarding state
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: topology change detected, propagating
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: port 3(eth2) entering forwarding state
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: topology change detected, propagating
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: port 4(wl0.1) entering forwarding state
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: topology change detected, propagating
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: vlan1: add 33:33:00:00:00:02 mcast address to master interface
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: port 1(vlan1) entering learning state
Dec 4 08:02:59 192.168.1.1 Aug 1 00:00:15 kernel: br0: port 2(eth1) entering learning state
Dec 4 08:03:00 192.168.1.1 Aug 1 00:00:16 dropbear[280]: Running in background
Dec 4 08:03:00 192.168.1.1 Aug 1 00:00:15 WAN_Connection: ISP's DHCP did not function properly.
Dec 4 08:03:00 192.168.1.1 Aug 1 00:00:15 stop_nat_rules: apply the redirect_rules!
[ ... rest of reboot]


Metrics:
CPU - ~20%
RAM - ~23%
Temp - 57/63

Notes:

The date weirdness in the logs happens every time it reboots, and fixes itself later in the process. I don't know if that's normal. EDIT: I've come to assume this is the exact moment it crashes.

I don't actually know if the cable I'm using is cat 5 or cat5e. It doesn't say. It came in my comcast self-start kit a few months ago. That said, it hasnt caused any problems up till the upgrade. Further, I'm not seeing any Ethernet Link is Up/Down logs.

I've read a bunch of posts here and elsewhere about similar issues, but none of them solved it for me or fit my situation.

Help?

 

[Scypher]

More info:

I no longer suspect DHCP from ISP, as my lease appears to be just shy of 4d.

I briefly thought maybe my LAN dhcp stuff was causing it, so I set my network lease time to 10m to troubleshoot. Everything is renewing without any issues.

NAT acceleration is and has always been off.

 

[Scypher]

Update:

I did a factory reset, after which it went overnight without crashing. The only settings being changed at this point being wifi configured and remote syslog server.
Then yesterday, I changed the hostname, set it to use my internal dns server, and turned on firewall logs. It crashed on the next divisible by 4 hour (midnight).
I set dns back to auto and went to bed. It crashed at 4am, which I saw when I got up at 7am.
I then turned firewall logs off, leaving dns on auto. 8am rolled around, no crash.

So right now it appears to be firewall logs causing. I plan to dig in more because I really want my firewall logs, but first will confirm that is the issue. I've set dns back to my internal server and will see if it crashes at noon. I expect it will not, at which point I will turn logs back and see if it crashes at 4pm, which would confirm it.

 

[Jack Yaz]

With the metrics posted, is this at idle or just before the 4hr crash? I'm wondering if there is a log rotation or some other scheduled job that is running the router out of memory every 4 hours on start of the job.

 

[Scypher]

Its pretty much constant from idle till the crashes. I haven't noticed any load spikes immediately prior to crash, but I'm also not collecting those metrics.

 

[martinr]

It’s likely you’ll get fed up with trying to find the cause and you’ll want to start all over again, in which case I recommend you follow L&LD’s minimal and manual guide:

https://www.snbforums.com/threads/n...l-and-manual-configuration.27115/#post-205573

At least if the problem persisted after that, you’d know for sure what it isn’t.