[DEVEL] Asuswrt-Merlin Remote Log Server (Syslog & Syslog-ng Synergy) to Centralize Primary Router & AiMesh Node System Logs

[elorimer]

Okay, so this guide should add:

1. Uninstall scribe and uiscribe first, and if you have skynet installed make sure the custom log is put back to /tmp/syslog.log. If not logging may be completely borked.
2. No sorting of logs into buckets--everything is back to syslog.
3. Syslogd is going to handle log rotation except for diversion.
4. The permanent log is going to /jffs again, and not the stick.
5. I'm not sure, to be honest, what will happen with /tmp/syslog.log if syslog-ng is writing to it and syslogd is writing to it at the same time, and how time-reap works there. I think syslogd messages will be lost while syslog-ng is holding the file open.
6. The nodes are rewritten to add hosts, but the main router isn't, so this can't be used to send logs elsewhere.

 

[garycnew]

All:

I've installed scribe and uiscribe, uncommented source net { udp(ip(192.168.0.1) port(514)); } and source(net), /opt/etc/init.d/S01syslog-ng reconfigure, and it appears to be receiving AiMesh Node System Logs per my previous nvram settings.

Now, I just need to create Syslog filters and I should be in business.

I wasn't trying to reinvent the wheel. I was only trying to create a solution for my needs and document it in the process to potentially assist others in the future.

I appreciate all the support and feedback in this endeavor.

Respectfully,


Gary

 

[elorimer]

uncommented source net { udp(ip(192.168.0.1) port(514)); }

This is an area where your guide can improve on scribe, in addition to documenting how the nodes should be setup. Have a look here: https://www.snbforums.com/threads/feature-to-support-aimesh-node-s-log.69868/page-2#post-680304

Since scribe was developed, the udp and tcp drivers have been deprecated, and replaced by the network() drivers. Network() defaults to udp and port 514. The old drivers still work in 3.32 but at some point they will stop.

 

[elorimer]

I set things up for my AiMesh node to send its logs on to my primary router and noticed a few additional things.

First, for some reason the remote server IP did not survive a reboot. So I activated the jffs scripts with nvram set jffs2_scripts=1 and commit. Then I created a services-start script in /jffs/scripts that just set log_ipaddr to my main router and commit, chmod then rebooted. That worked.

Second, doing it that way means the logs don't start getting sent until late in the boot, so I haven't figured out a way to capture the beginning of the logging. But from that point on I could sort the node into its own bucket.

 

[garycnew]

First, for some reason the remote server IP did not survive a reboot. So I activated the jffs scripts with nvram set jffs2_scripts=1 and commit. Then I created a services-start script in /jffs/scripts that just set log_ipaddr to my main router and commit, chmod then rebooted. That worked.

@elorimer

I'm glad your workaround works, but it shouldn't be necessary.

It's strange that your remote syslog server IP doesn't survive in committed nvram after the AiMesh node is rebooted.

It's strange that you can commit jffs2_scripts, but not the log_ipaddr variable.

Which Asuswrt-Merlin firmware are you on?

Has the log_ipaddr variable changed in that release?

You might open a bug report, if this issue isn't already known.

Respectfully,


Gary

P.S. If I remember correctly... I never had to set my log_ipaddr nvram variable on the AiMesh nodes as it was already populated by configuring the syslog server address in the gui of the primary router.

 

[elorimer]

P.S. If I remember correctly... I never had to set my log_ipaddr nvram variable on the AiMesh nodes as it was already populated by configuring the syslog server address in the gui of the primary router.

Because I am using scribe and uiscribe, that isn't offered as an option. Also, not sure why setting the remote server for the primary router would set the primary router as the remote server for the node.

Also, I haven't fooled with AiMesh enough to know for sure, but when you add a node, doesn't that effectively do a factory reset of the node?

I don't think this is a bug though. I posted it as something that one might want to watch out for.

 

[garycnew]

Because I am using scribe and uiscribe, that isn't offered as an option. Also, not sure why setting the remote server for the primary router would set the primary router as the remote server for the node.

AiMesh Nodes inherit some of the nvram variables from the primary router. I'm fairly positive that is what is happening with your log_ipaddr nvram variable on your AiMesh Node. After your AiMesh Node is rebooted, it's inheriting the empty log_ipaddr variable from the primary router. In my case, I had already configured my syslog server address (log_ipaddr) on my primary router prior to upgrading to scribe and uiscribe, so it continued to persist.

Also, I haven't fooled with AiMesh enough to know for sure, but when you add a node, doesn't that effectively do a factory reset of the node?

Only on the initial adding/upgrading of an AiMesh Node does the AiMesh Node get factory reset. Thereafter, it continues to maintain most of its customizations. Several of my AiMesh Nodes are configured to perform different side-hustles. You can even turn the wifi radios off for any given AiMesh Node, which is great for troubleshooting your AiMesh network.

Try configuring the log_ipaddr variable on your primary router, commit the change, disable the workaround on your AiMesh Node, reboot your AiMesh Node, and see whether your AiMesh Node inherits the log_ipaddr variable from the primary router.

If worst comes to worse, you could always uninstall scribe and uiscribe, configure the syslog server in the primary router gui, and then reinstall scribe and uiscribe.

It has been working flawlessly for me for months.

I hope it helps you.

Respectfully,


Gary

 

[elorimer]

AiMesh Nodes inherit some of the nvram variables from the primary router. I'm fairly positive that is what is happening with your log_ipaddr nvram variable on your AiMesh Node. After your AiMesh Node is rebooted, it's inheriting the empty log_ipaddr variable from the primary router.

Quite so. My primary router had that nvram variable zeroed out. So inserted its own address there, then went to the node, disabled jffs scripts, deleted my service-start script, zeroed out the logip address, and rebooted.

The log messages started showing up in the main router as before, and back in the node the logip address was populated. That suggests this is a variable that doesn't persist and gets repopulated from the main router.

Thanks for straightening me out. Move this thread to addons?

 

[garycnew]

Thanks for straightening me out. Move this thread to addons?

I'm glad that did the trick. You're welcome to move this post wherever you think is most appropriate. Enjoy!