Help with writing a simple "wl radio off && wl radio on" script!! please!!

Martineau · Mar 17, 2020

Adam Popiel said:
@Martineau ,

so you put this command somewhere inside the script??
[ -n "$(echo "$SYSLOG" | grep -oE "$MAC_LIST")" ] && { SyslogEmail; Process_ACTION; }

also, in version 1.02, you mentioned to use:

Code:
MSG0001T="Light Bulb Monitor" # Title for Syslog messages/SendMail
MSG0001C=-99999 # DOWN message count
MSG0001D="DHCPDISCOVER(br0)" # DOWN Trigger message
MSG0001U="DHCPACK(br0)" # UP message: Reset monitoring/recovery action message
MSG0001XU= # UP action script
MSG0001XD="/jffs/scripts/Restart_Radio.sh" # DOWN action script

MAC_LIST="c8:2b:96:4e:94:bb|c8:2b:96:4e:94:bc|c8:2b:96:4e:94:bd"

MSG0001C=-99999, but in the new code for me v1.03 i see that this is set to 0. is this correct?

Try the new script

EDIT: How to test.

To prevent spamming Syslog (and your email inbox) you should modify the script LINE:201 ONLY

Code:

[ -n "$DESC" ] && { SyslogEmail; Process_ACTION; }

change to

Code:

[ -z "$(ps -w | grep -v grep | grep Restart_Radio)" ] && [ -n "$DESC" ] && { SyslogEmail; Process_ACTION; }

or download v1.04

Testing (I created a separate script rather than modify my current SyslogEventMonitor monitoring)

Code:

./LightBulbMonitor.sh &

admin@RT-AC68U:/jffs/scripts# (LightBulbMonitor.sh): 31295 v1.04 Syslog Event Monitor started.....

Hit Enter

Code:

./LightBulbMonitor.sh status

(LightBulbMonitor.sh): 31333 v1.04 Syslog Event monitor ACTIVE PID=31295

Now we can spoof the expected behaviour i.e. 9 consecutive DHCPDISCOVER failure messages for a matching lightbulb MAC, then one successful DHCPACK assignment:

Code:

echo -e "DHCPDISCOVER(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log
echo -e "DHCPDISCOVER(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log
echo -e "DHCPDISCOVER(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log
echo -e "DHCPDISCOVER(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log
echo -e "DHCPDISCOVER(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log
echo -e "DHCPDISCOVER(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log
echo -e "DHCPDISCOVER(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log
echo -e "DHCPDISCOVER(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log
echo -e "DHCPDISCOVER(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log
echo -e "DHCPACK(br0) c8:2b:96:4e:94:bc"  >> /tmp/syslog.log

and viewing the ouput in Syslog

Code:

[CODE]Mar 17 18:39:18 RT-AC68U (LightBulbMonitor.sh): 32761 v1.04 Syslog Event Monitor started.....
Mar 17 18:39:19 RT-AC68U (LightBulbMonitor.sh): 32761 Light Bulb Monitor Lightbulb DHCP detected c8:2b:96:4e:94:bc; Action='/jffs/scripts/Restart_Radio.sh'
Mar 17 18:39:20 RT-AC68U (LightBulbMonitor.sh): 32761 e-mail sent using curl smtps:// SSL/TLS (non-Certificate) mysmtp.server.com:nnn
Mar 17 18:39:20 RT-AC68U (Restart_Radio.sh): 380 1.01 Restarting Radio.....
DHCPDISCOVER(br0) c8:2b:96:4e:94:bc
DHCPDISCOVER(br0) c8:2b:96:4e:94:bc
DHCPDISCOVER(br0) c8:2b:96:4e:94:bc
DHCPDISCOVER(br0) c8:2b:96:4e:94:bc
DHCPDISCOVER(br0) c8:2b:96:4e:94:bc
DHCPDISCOVER(br0) c8:2b:96:4e:94:bc
DHCPDISCOVER(br0) c8:2b:96:4e:94:bc
DHCPDISCOVER(br0) c8:2b:96:4e:94:bc
DHCPDISCOVER(br0) c8:2b:96:4e:94:bc
DHCPACK(br0) c8:2b:96:4e:94:bc
Mar 17 18:40:24 RT-AC68U (LightBulbMonitor.sh): 32761 Light Bulb Monitor re-initialised c8:2b:96:4e:94:bc; Action=''
Mar 17 18:40:25 RT-AC68U (LightBulbMonitor.sh): 32761 e-mail sent using curl smtps:// SSL/TLS (non-Certificate) mysmtp.server.com:nnn

Terminate the monitoring

Code:

./LightBulbMonitor.sh stop

(LightBulbMonitor.sh): 31372 v1.04 Syslog Event monitor Termination requested PID=31295

admin@RT-AC68U:/jffs/scripts# (LightBulbMonitor.sh): 31295 Syslog Event Monitor external termination trigger.....terminating

 ./LightBulbMonitor.sh status
(LightBulbMonitor.sh): 32316 v1.04 Syslog Event monitor not running

octopus · Mar 21, 2020

Martineau said:
<sigh>
Download your custom specific v1.03 of the script and make sure you recreate the Restart_Radio.sh from post #2

Dead link.... any uppdate?

Martineau · Mar 21, 2020

octopus said:
Dead link.... any uppdate?

The link to the generic v1.02 of the script in post #2 is still valid.

However, for the OP's specific use case, the script needs a slight tweak

i.e. with effectively a simple (logical) one-line change, the script's original design criteria has gone from

"Trigger on the FIRST predefined "DOWN" event message"

to

"Trigger on the FIRST matching MAC (from a pre-defined list) "DOWN" event message"

Whilst the very simple code changes are documented in the thread to create v1.04, as the OP clearly struggled to follow the instructions, it was provided as a temporary link, but I'll include the main body of the code here:

e.g. copy'n'paste the code below to replace the main body of the v1.02 script to create the specific MAC-based Light Bulb Monitor

Code:

#------------------------------------Start of customisation----------------------------------------------------------------
MSG0001T="Light Bulb Monitor"                  # Title for Syslog messages/SendMail
MSG0001C=0                                     # DOWN message count
MSG0001D="DHCPDISCOVER(br0)"                   # DOWN Trigger message will apply sub-field MAC_LIST filter
MSG0001U="DHCPACK(br0)"                        # UP message: Reset monitoring/recovery action message
MSG0001XU=                                     # UP action script
MSG0001XD="/jffs/scripts/Restart_Radio.sh"     # DOWN action script
MAC_LIST="c8:2b:96:4e:94:bb|c8:2b:96:4e:94:bc|c8:2b:96:4e:94:bd"   # v1.04 Subfield filter i.e. specific MACs
#------------------------------------End of customisation----------------------------------------------------------------

# Track the Syslog events i.e Specifically - Lightbulb MAC DHCP related
tail -F /tmp/syslog.log | \
    while read SYSLOG
        do
            case "$SYSLOG" in
                *$MSG0001D*|*$MSG0001U*)                                # DOWN/UP pair
                    TAG="$MSG0001T"
                    REASON="Trigger"
                    [ -z "MSG0001CT" ] && MSG0001CT=0                   # v1.02
                    case "$SYSLOG" in
                        *$MSG0001D*)                                    # DOWN event
                            MSG0001CT=$((1+MSG0001CT))                  # v1.02
                            ACTION=$MSG0001XD                           # DOWN ACTION script
                            #if [ $MSG0001CT -eq $MSG0001C ];then       # v1.03 NOT required when using sub-field filter v1.02 Apply trigger threshold logic
                                REASON="Lightbulb DHCP detected"
                                DESC="$(echo "$SYSLOG" | grep -oE "$MAC_LIST")"     # v1.04 Does sub-field filter match?
                                [ -z "$(ps -w | grep -v grep | grep Restart_Radio)" ] && [ -n "$DESC" ] && { SyslogEmail; Process_ACTION; } # v1.04
                            #fi                                         # v1.03 NOT required when using sub-field            
                            ;;
                        *$MSG0001U*)                                    # UP event
                            #MSG0001CU=$((1+MSG0001CU))
                            ACTION=$MSG0001XU                           # UP ACTION script
                            REASON="re-initialised"
                            DESC="$(echo "$SYSLOG" | grep -oE "$MAC_LIST")"      # v1.04
                            [ -n "$DESC" ] && { SyslogEmail; Process_ACTION; }   # v1.04
                            MSG0001CT=0                                 # v 1.02 Reset DOWN trigger threshold counter
                            ;;
                    esac
                    ;;
                #
                #*$MSG9999U*|*$MSG9999D*)                               # Repeat for additional triggers
                #   TAG=
                #   REASON=
                #   etc.
                *)
                    # No trigger message match
                    ;;
            esac
            # Check for external kill switch; NOTE: Termination can be delayed on a quiet system!
            if [ ! -f "$LOCKFILE" ];then                        # Tacky! should really check for a separate 'KILL' file?
                echo -en $cBYEL
                Say "Syslog Event Monitor external termination trigger.....terminating"
                echo -e $cRESET
                flock -u $FD
                exit
            fi
        done

"Teach a man to fish etc....."

Adam Popiel · Mar 21, 2020

Ok so i made the changes you mentioned and this is what I have. I'm attaching the syslogs and the running scripts.

So if you can see by the logs, the script does to initial job by fishing out the mac address and restarting the wifi, and it does that for every MAC address, so that is great success. But then, for some reason the scripts keep repeating the restart wifi script:

The below posted ssh output will match the timestamps of the log I've attached:

>>>Time when I turn on my 3 lightbulbs>>>
Mar 21 21:46:45 dnsmasq-dhcp[4745]: DHCPDISCOVER(br0) c8:2b:96:4e:b7:e4
Mar 21 21:46:45 dnsmasq-dhcp[4745]: DHCPOFFER(br0) 192.168.1.105 c8:2b:96:4e:b7:e4
Mar 21 21:46:45 dnsmasq-dhcp[4745]: DHCPDISCOVER(br0) c8:2b:96:4e:df:6e
Mar 21 21:46:45 dnsmasq-dhcp[4745]: DHCPOFFER(br0) 192.168.1.84 c8:2b:96:4e:df:6e
Mar 21 21:46:45 dnsmasq-dhcp[4745]: DHCPDISCOVER(br0) c8:2b:96:4f:24:3a
Mar 21 21:46:45 dnsmasq-dhcp[4745]: DHCPOFFER(br0) 192.168.1.20 c8:2b:96:4f:24:3a
>>>Start of script>>>Mar 21 21:47:34 (SyslogEventMonitor.sh): 23614 v1.03 Syslog Event Monitor started.....
>>Script termination>>>Mar 21 21:48:48 (SyslogEventMonitor.sh): 29347 Syslog Event monitor Termination requested PID=23614
Mar 21 21:48:48 (SyslogEventMonitor.sh): 23614 Syslog Event Monitor external termination trigger.....terminating

maybe you can see something in the script that's off?
maybe there is a way to tell the script that once it sees one ack request to stop searching for the discover requests anymore for that particular MAC address?

attached are the 2 scripts that you made for me with corrections and the complete system logs

Best regards,

Adam Popiel

Adam Popiel · Mar 21, 2020

ok so i added a line to the restart wifi script to stop the constant restarting wifi and it works!! so what is happening is your script executing and as soon as it finds one action it performs the restart wifi script and I've added the extra "/jffs/scripts/./SyslogEventMonitor.sh stop" line to stop it running. U see I have one chandalier in my living room with these 3 lightbulbs so when I turn on the light switch all 3 go on and start the whole process. Thats why I see that if I add this: "/jffs/scripts/./SyslogEventMonitor.sh stop" it effectively looks for any of those mac addresses and as soon as it fins one it runs the new modified Restart_Radio.sh

#! /bin/sh
logger -st "($(basename $0))" "Restarting Radio....."
wl radio off && wl radio on && /jffs/scripts/./SyslogEventMonitor.sh stop

Now this works because you're a genius!!

but I there would be a way to start the SyslogEventMonitor.sh script again 3-5 minutes after a successful Restart_Radio.sh run? I hope you know what I mean by this.

So I think I need something like

IF: SyslogEventMonitor.sh is running and it catches a trigger and then performs the action which is to run Restart_Radio.sh
THEN: run SyslogEventMonitor.sh again in 5 minutes.

I think this would work perfect!

I guess i can leave everything as is now and just run a corn job on SyslogEventMonitor.sh to run it every in 5 mins, because it would only really start only after a successful trigger trip right?

Martineau · Mar 21, 2020

Adam Popiel said:
ok so i added a line to the restart wifi script to stop the constant restarting wifi and it works!! so what is happening is your script executing and as soon as it finds one action it performs the restart wifi script and I've added the extra "/jffs/scripts/./SyslogEventMonitor.sh stop" line to stop it running. U see I have one chandalier in my living room with these 3 lightbulbs so when I turn on the light switch all 3 go on and start the whole process. Thats why I see that if I add this: "/jffs/scripts/./SyslogEventMonitor.sh stop" it effectively looks for any of those mac addresses and as soon as it fins one it runs the new modified Restart_Radio.sh

#! /bin/sh
logger -st "($(basename $0))" "Restarting Radio....."
wl radio off && wl radio on && /jffs/scripts/./SyslogEventMonitor.sh stop

Now this works because you're a genius!!

but I there would be a way to start the SyslogEventMonitor.sh script again 3-5 minutes after a successful Restart_Radio.sh run? I hope you know what I mean by this.

So I think I need something like

IF: SyslogEventMonitor.sh is running and it catches a trigger and then performs the action which is to run Restart_Radio.sh
THEN: run SyslogEventMonitor.sh again in 5 minutes.

I think this would work perfect!

I guess i can leave everything as is now and just run a corn job on SyslogEventMonitor.sh to run it every in 5 mins, because it would only really start only after a successful trigger trip right?

You didn't follow the instructions in post #19 to create v1.01 of 'Restart_Radio.sh'

You MUST use the two scripts that I provided as-is.
This ensures as per the testing instructions, that the Restart_Radio.sh script will only restart the WiFi once every five minutes, so it honours the DOWN/UP for a single matching MAC pair in that interval.

Once you are satisfied with the code I wrote, then you would simply need to ensure the monitoring script is started once during the boot process (in the background) to permanently monitor the lightbulbs.

i.e. services-start

Code:

sh /jffs/scripts/SyslogEventMonitor.sh &

Adam Popiel · Mar 22, 2020

Hey @Martineau ,

Im sorry for looking like i can't follow directions

I've done what you told me and recreated the script from post 19 and now it looks to be working just as you said - one restart per 5 minutes and it wont restart until it sees another dhcp mac trigger. THANK YOU!!!!
------------------------------------------------------------------------------------------------------------------

apopiel85@RT-AC86U-61D0:/jffs/scripts# ls
Restart_Radio.sh SyslogEventMonitor.sh
Restart_Radio.sh.save firewall
apopiel85@RT-AC86U-61D0:/jffs/scripts# rm Restart_Radio.sh
apopiel85@RT-AC86U-61D0:/jffs/scripts# ls
Restart_Radio.sh.save SyslogEventMonitor.sh firewall
apopiel85@RT-AC86U-61D0:/jffs/scripts# echo -e "#!/bin/sh\n\nVER=\"1.01\"\n\nLOC
KFILE=\"/tmp/\$(basename \$0)-flock\"\nFD=149\neval exec \"\$FD>\$LOCKFILE\"\nfl
ock -n \$FD || { logger -st \"\$(basename \$0)\" \$\$ \"\$VER ALREADY running...
ABORTing\"; exit; }\n\nlogger -st \"(\$(basename \$0))\" \$\$ \"\$VER Restarting
Radio.....\"\nwl radio off && wl radio on\n\nsleep 300" > /jffs/scripts/Restart
_Radio.sh;chmod +x /jffs/scripts/Restart_Radio.sh
apopiel85@RT-AC86U-61D0:/jffs/scripts# ls
Restart_Radio.sh SyslogEventMonitor.sh
Restart_Radio.sh.save firewall
apopiel85@RT-AC86U-61D0:/jffs/scripts# nano Restart_Radio.sh
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh &
apopiel85@RT-AC86U-61D0:/jffs/scripts# (SyslogEventMonitor.sh): 17391 v1.03 Syslog Event Monitor started.....
(SyslogEventMonitor.sh): 17391 e-mail sent using curl smtps:// SSL/TLS (non-Certificate) mysmtp.server.com:nnn
./SyslogEventMonitor.sh: line 233: can't create : nonexistent directory
(Restart_Radio.sh): 17453 1.01 Restarting Radio.....

apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh status

(SyslogEventMonitor.sh): 17731 Syslog Event monitor ACTIVE PID=17391

apopiel85@RT-AC86U-61D0:/jffs/scripts# ls
Restart_Radio.sh SyslogEventMonitor.sh
Restart_Radio.sh.save firewall
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh status

(SyslogEventMonitor.sh): 18869 Syslog Event monitor ACTIVE PID=17391

apopiel85@RT-AC86U-61D0:/jffs/scripts# nano services-start
apopiel85@RT-AC86U-61D0:/jffs/scripts#
----------------------------------------------------------------------------------------

I've also added a file called services-start in /jffs/scripts and added this line:

sh /jffs/scripts/SyslogEventMonitor.sh &

----------------------------------------------------
my question now is, do you need to put chmod executive permissions to start this after reboot or will it now run automatically?

Adam Popiel · Mar 22, 2020

@Martineau YOU ARE A GOD!!!!!!! THANK YOU SOO MUCH, It all works now with all 10 MAC addresses.

my one last remaining question

why cant I manually stop the script anymore
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh status

(SyslogEventMonitor.sh): 5869 Syslog Event monitor ACTIVE PID=4584

apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh -stop
(SyslogEventMonitor.sh): 5902 v1.03 Syslog Event Monitor started.....
(SyslogEventMonitor.sh): 5902 Syslog Event monitor ALREADY running...ABORTing
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh stop

(SyslogEventMonitor.sh): 5930 Syslog Event monitor Termination requested

apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh status

grep: /tmp/SyslogEventMonitor.sh-running: No such file or directory
(SyslogEventMonitor.sh): 5980 Syslog Event monitor ACTIVE

apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh stop
(SyslogEventMonitor.sh): 6012 v1.03 Syslog Event Monitor started.....
^C
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh stop &
apopiel85@RT-AC86U-61D0:/jffs/scripts#
(SyslogEventMonitor.sh): 6053 Syslog Event monitor Termination requested PID=6012
-------------------------------------------------------------------------------------------

even when I do the stop command after the script it says termination requested but when I check status its still says its running

Adam Popiel · Mar 22, 2020

Even when I take out the line you told me to put in services-start file, after reboot the script looks like its active, which is certainly not a bad thing but I just want to understand why I cant terminate it with the stop command anymore
and when I do ./SyslogEventMonitor.sh stop it actually starts the script when it was already active?

ASUSWRT-Merlin RT-AC86U 384.15_0 Sat Feb 8 18:41:28 UTC 2020
apopiel85@RT-AC86U-61D0:/tmp/home/root# cd /jffs/scripts/
apopiel85@RT-AC86U-61D0:/jffs/scripts# ls
Restart_Radio.sh SyslogEventMonitor.sh services-start
Restart_Radio.sh.save firewall
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh status

grep: /tmp/SyslogEventMonitor.sh-running: No such file or directory
(SyslogEventMonitor.sh): 3881 Syslog Event monitor ACTIVE

apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh stop
(SyslogEventMonitor.sh): 4104 v1.03 Syslog Event Monitor started....

Adam Popiel · Mar 22, 2020

apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh stop
(SyslogEventMonitor.sh): 4104 v1.03 Syslog Event Monitor started.....
^C
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh stop

(SyslogEventMonitor.sh): 4724 Syslog Event monitor Termination requested PID=4104

apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh status

grep: /tmp/SyslogEventMonitor.sh-running: No such file or directory
(SyslogEventMonitor.sh): 4761 Syslog Event monitor ACTIVE

apopiel85@RT-AC86U-61D0:/jffs/scripts# cd /tmp
apopiel85@RT-AC86U-61D0:/tmp# ls
APPS mnt
SyslogEventMonitor.sh-20200322-094638 nat_rules
allwclientlist.json nat_rules_eth0_eth0
aplist.json nc
asus_app netool
asus_router.conf notify
asusfbsvcs obstatus
avahi obvsie
bwdpi opt
chanspec_all.json ppp
chanspec_avbl.json redirect_rules
chanspec_avbl.txt relist.json
chanspec_private.json resolv.conf
clientlist.json resolv.dnsmasq
confmtd run_lldpd.sh
db settings
ddns.cache share
dev syslog.log
dhcp6c syslog.log-1
dm2_amule_status udhcpc
dm_mount_path_n udhcpc0.expires
ebtables.lock usb.log
etc usb_err
filter.default usb_hd_num
filter_ipv6.default usbinfo
filter_rules usbinfo_lock
fsck_ret var
have_dm2 watchdog_heartbeat
home wchannel.json
hw_auth_clm webs_upgrade.log
inadyn.cache wiredclientlist.json
ipsec_stack_block_size wpa_cli
lld2d.conf wps_monitor.pid
mastiff.pid zcip
mastiff_log
apopiel85@RT-AC86U-61D0:/tmp# /jffs/scripts/SyslogEventMonitor.sh stop
(SyslogEventMonitor.sh): 4990 v1.03 Syslog Event Monitor started.....

Adam Popiel · Mar 22, 2020

everything works as it should, THANK YOU!!!!

Mar 22 10:13:02 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) 2c:f4:32:e4:8b:7e
Mar 22 10:13:02 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.91 2c:f4:32:e4:8b:7e
Mar 22 10:13:02 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) 2c:f4:32:e4:8b:7e
Mar 22 10:13:02 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.91 2c:f4:32:e4:8b:7e
Mar 22 10:13:02 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.91 2c:f4:32:e4:8b:7e
Mar 22 10:13:02 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.91 2c:f4:32:e4:8b:7e ZENGGE_35_E48B7E
Mar 22 10:13:15 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=45.141.84.17 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=26723 PROTO=TCP SPT=44542 DPT=7737 SEQ=2830608164 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 10:13:20 kernel: nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
Mar 22 10:13:20 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=45.143.220.18 DST=217.120.209.126 LEN=442 TOS=0x00 PREC=0x00 TTL=57 ID=33657 DF PROTO=UDP SPT=5080 DPT=5060 LEN=422 MARK=0x8000000
Mar 22 10:13:21 wlceventd: WLCEVENTD wlceventd_proc_event(420): eth5: Auth C8:2B:96:4E:B7:E4, status: 0, reason: d11 RC reserved (0)
Mar 22 10:13:21 wlceventd: WLCEVENTD wlceventd_proc_event(449): eth5: Assoc C8:2B:96:4E:B7:E4, status: 0, reason: d11 RC reserved (0)
Mar 22 10:13:21 wlceventd: WLCEVENTD wlceventd_proc_event(420): eth5: Auth C8:2B:96:4E

F:6E, status: 0, reason: d11 RC reserved (0)
Mar 22 10:13:21 wlceventd: WLCEVENTD wlceventd_proc_event(449): eth5: Assoc C8:2B:96:4E

F:6E, status: 0, reason: d11 RC reserved (0)
Mar 22 10:13:21 wlceventd: WLCEVENTD wlceventd_proc_event(420): eth5: Auth C8:2B:96:4F:24:3A, status: 0, reason: d11 RC reserved (0)
Mar 22 10:13:21 wlceventd: WLCEVENTD wlceventd_proc_event(449): eth5: Assoc C8:2B:96:4F:24:3A, status: 0, reason: d11 RC reserved (0)
Mar 22 10:13:26 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=185.156.73.60 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=10996 PROTO=TCP SPT=52778 DPT=3836 SEQ=1549858166 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 10:13:26 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:b7:e4
Mar 22 10:13:26 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.105 c8:2b:96:4e:b7:e4
Mar 22 10:13:30 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4f:24:3a
Mar 22 10:13:30 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.20 c8:2b:96:4f:24:3a
Mar 22 10:13:34 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=213.217.0.134 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=12579 PROTO=TCP SPT=44815 DPT=62684 SEQ=4001109121 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:df:6e
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.84 c8:2b:96:4e:df:6e
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.105 c8:2b:96:4e:b7:e4
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.105 c8:2b:96:4e:b7:e4 ZENGGE_35_4EB7E4
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4f:24:3a
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.20 c8:2b:96:4f:24:3a
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:df:6e
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.84 c8:2b:96:4e:df:6e
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.105 c8:2b:96:4e:b7:e4
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.105 c8:2b:96:4e:b7:e4 ZENGGE_35_4EB7E4
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.105 c8:2b:96:4e:b7:e4
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.105 c8:2b:96:4e:b7:e4 ZENGGE_35_4EB7E4
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.20 c8:2b:96:4f:24:3a
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.20 c8:2b:96:4f:24:3a ZENGGE_35_4F243A
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.84 c8:2b:96:4e:df:6e
Mar 22 10:13:34 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.84 c8:2b:96:4e:df:6e ZENGGE_35_4EDF6E
Mar 22 10:13:56 wlceventd: WLCEVENTD wlceventd_proc_event(420): eth5: Auth C8:2B:96:4E:E7

D, status: 0, reason: d11 RC reserved (0)
Mar 22 10:13:56 wlceventd: WLCEVENTD wlceventd_proc_event(420): eth5: Auth C8:2B:96:4E:E7

D, status: 0, reason: d11 RC reserved (0)
Mar 22 10:13:56 wlceventd: WLCEVENTD wlceventd_proc_event(449): eth5: Assoc C8:2B:96:4E:E7

D, status: 0, reason: d11 RC reserved (0)
Mar 22 10:14:00 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:e7:dd
Mar 22 10:14:00 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.12 c8:2b:96:4e:e7:dd
Mar 22 10:14:00 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:e7:dd
Mar 22 10:14:00 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.12 c8:2b:96:4e:e7:dd
Mar 22 10:14:00 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.12 c8:2b:96:4e:e7:dd
Mar 22 10:14:00 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.12 c8:2b:96:4e:e7:dd ZENGGE_35_4EE7DD
Mar 22 10:14:09 wlceventd: WLCEVENTD wlceventd_proc_event(420): eth5: Auth C8:2B:96:4E:B5:16, status: 0, reason: d11 RC reserved (0)
Mar 22 10:14:09 wlceventd: WLCEVENTD wlceventd_proc_event(449): eth5: Assoc C8:2B:96:4E:B5:16, status: 0, reason: d11 RC reserved (0)
Mar 22 10:14:09 wlceventd: WLCEVENTD wlceventd_proc_event(420): eth5: Auth C8:2B:96:4E:E4:24, status: 0, reason: d11 RC reserved (0)
Mar 22 10:14:09 wlceventd: WLCEVENTD wlceventd_proc_event(449): eth5: Assoc C8:2B:96:4E:E4:24, status: 0, reason: d11 RC reserved (0)
Mar 22 10:14:09 wlceventd: WLCEVENTD wlceventd_proc_event(420): eth5: Auth C8:2B:96:4E:94:BB, status: 0, reason: d11 RC reserved (0)
Mar 22 10:14:09 wlceventd: WLCEVENTD wlceventd_proc_event(449): eth5: Assoc C8:2B:96:4E:94:BB, status: 0, reason: d11 RC reserved (0)
Mar 22 10:14:12 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:e4:24
Mar 22 10:14:12 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.117 c8:2b:96:4e:e4:24
Mar 22 10:14:13 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=198.108.67.110 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=38 ID=18494 PROTO=TCP SPT=4587 DPT=8731 SEQ=3999056304 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 10:14:16 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:94:bb
Mar 22 10:14:16 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.74 c8:2b:96:4e:94:bb
Mar 22 10:14:16 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:94:bb
Mar 22 10:14:16 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.74 c8:2b:96:4e:94:bb
Mar 22 10:14:18 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=213.217.0.132 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=5087 PROTO=TCP SPT=40110 DPT=36017 SEQ=2161921552 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:b5:16
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.8 c8:2b:96:4e:b5:16
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:e4:24
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.117 c8:2b:96:4e:e4:24
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:94:bb
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.74 c8:2b:96:4e:94:bb
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:b5:16
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.8 c8:2b:96:4e:b5:16
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:e4:24
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.117 c8:2b:96:4e:e4:24
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.74 c8:2b:96:4e:94:bb
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.74 c8:2b:96:4e:94:bb ZENGGE_35_4E94BB
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.74 c8:2b:96:4e:94:bb
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.74 c8:2b:96:4e:94:bb ZENGGE_35_4E94BB
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.8 c8:2b:96:4e:b5:16
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.8 c8:2b:96:4e:b5:16 ZENGGE_35_4EB516
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPREQUEST(br0) 192.168.1.117 c8:2b:96:4e:e4:24
Mar 22 10:14:19 dnsmasq-dhcp[974]: DHCPACK(br0) 192.168.1.117 c8:2b:96:4e:e4:24 ZENGGE_35_4EE424
Mar 22 10:14:21 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=194.26.29.124 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=182 ID=28796 PROTO=TCP SPT=44285 DPT=1110 SEQ=34448724 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 10:14:39 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=210.51.57.10 DST=217.120.209.126 LEN=34 TOS=0x00 PREC=0x00 TTL=50 ID=7881 PROTO=ICMP TYPE=8 CODE=0 ID=7881 SEQ=0 MARK=0x8000000
Mar 22 10:14:54 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=206.189.181.12 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=28022 PROTO=TCP SPT=34377 DPT=23 SEQ=3648573822 ACK=0 WINDOW=37977 RES=0x00 SYN URGP=0 MARK=0x8000000

if there is anywhere where I can donate to for you personally or for a good cause, just let me know, I really appreciate your help

Martineau · Mar 22, 2020

EDIT: A lot of info has been posted between me seeing your first post this morning,(and you appear to have resolved your issues) but I might as well post my original reply in case others will benefit from my reply.

Adam Popiel said:
I've also added a file called services-start in /jffs/scripts and added this line:
sh /jffs/scripts/SyslogEventMonitor.sh &

Adam Popiel said:
my question now is, do you need to put chmod executive permissions to start this after reboot or will it now run automatically?

As per the Wiki/documentation for Asuswrt-merlin which contains a wealth of useful info, particularly under the section

i.e. this section Creating scripts should answer your query.

Adam Popiel said:
Even when I take out the line you told me to put in services-start file, after reboot the script looks like its active

Shouldn't be possible? i.e. scripts can't suddenly decide on their own to execute.

Adam Popiel said:
why I cant terminate it with the stop command anymore

So it did work before?

When you request the 'stop' (not '-stop') the physical termination will only occur when the next message (can be anything) appears in Syslog.

So if you are using scribe/syslog-ng to filter the messages, then this increases the delay between requesting the script to self-terminate and the script actually acknowledging/obeying the request.

FYI - the existence of the sempahore file '/tmp/SyslogEventMonitor.sh-running' is the method used to communicate with the background monitoring task, and whilst crude, is easily understood.
Perhaps I should now use an internal 'signal trap' or I could simply blast the background task (PID) out of existence, but ideally background tasks should preferably be given a chance to finish what they are doing and 'tidy-up' before exiting in a controlled manner.

Adam Popiel said:
when I do ./SyslogEventMonitor.sh stop it actually starts the script when it was already active?

Did you mean 'inactive'?

…..but probably shoddy coding?

- although in my defence I wouldn't expect a stop request to be submitted immediately after a status command shows it as not running?.

However, in most cases wouldn't you expect the event monitoring to be deemed crucial in maintaining the integrity of your environment, otherwise there would be no need for it?, so this spurious behaviour is perhaps not a bad thing?

Adam Popiel said:
if there is anywhere where I can donate to for you personally or for a good cause, just let me know, I really appreciate your help

No need to donote to me personally, but... I know my instructions may seem useless, but in the future, if you do need to use anymore of my posts, please follow them correctly!!! - that will be enough.

Adam Popiel said:
everything works as it should, THANK YOU!!!!

Famous last words?

Glad to help.

Adam Popiel · Mar 22, 2020

@Martineau just checked again and i got this:

Mar 22 11:21:17 (SyslogEventMonitor.sh): 10851 Syslog Event monitor ACTIVE
Mar 22 11:21:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:b7:e4
Mar 22 11:21:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.105 c8:2b:96:4e:b7:e4
Mar 22 11:21:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4f:24:3a
Mar 22 11:21:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.20 c8:2b:96:4f:24:3a
Mar 22 11:21:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) 2c:f4:32:e4:8b:7e
Mar 22 11:21:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.91 2c:f4:32:e4:8b:7e
Mar 22 11:21:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:df:6e
Mar 22 11:21:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.84 c8:2b:96:4e:df:6e
Mar 22 11:21:52 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=185.176.27.34 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=34306 PROTO=TCP SPT=46767 DPT=6299 SEQ=730681319 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:21:56 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=213.217.0.134 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=16464 PROTO=TCP SPT=44815 DPT=62740 SEQ=2319672378 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:22:02 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=213.217.0.134 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=64722 PROTO=TCP SPT=44815 DPT=62059 SEQ=1246224327 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:22:07 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=213.217.0.132 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=2726 PROTO=TCP SPT=52448 DPT=37141 SEQ=260852429 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:22:17 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=185.176.27.30 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=45162 PROTO=TCP SPT=44248 DPT=6290 SEQ=1387559302 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:22:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4f:24:3a
Mar 22 11:22:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.20 c8:2b:96:4f:24:3a
Mar 22 11:22:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:b7:e4
Mar 22 11:22:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.105 c8:2b:96:4e:b7:e4
Mar 22 11:22:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) 2c:f4:32:e4:8b:7e
Mar 22 11:22:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.91 2c:f4:32:e4:8b:7e
Mar 22 11:22:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:df:6e
Mar 22 11:22:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.84 c8:2b:96:4e:df:6e
Mar 22 11:22:22 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=80.82.64.210 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=24940 PROTO=TCP SPT=54825 DPT=1129 SEQ=1123923067 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:22:25 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=165.22.244.40 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x40 TTL=242 ID=54321 PROTO=TCP SPT=44352 DPT=60001 SEQ=2399066092 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:22:28 dropbear[10984]: Child connection from 222.186.180.142:39286
Mar 22 11:22:29 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=37.49.231.127 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=28423 PROTO=TCP SPT=50032 DPT=50802 SEQ=1926854667 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:22:30 dropbear[10984]: Exit before auth: Disconnect received
Mar 22 11:22:40 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=185.156.73.60 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=22775 PROTO=TCP SPT=52778 DPT=3357 SEQ=1994163348 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:22:55 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=162.243.130.239 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=TCP SPT=48173 DPT=1931 SEQ=3004507785 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:23:01 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=206.189.181.12 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=28022 PROTO=TCP SPT=34377 DPT=23 SEQ=3648573822 ACK=0 WINDOW=37977 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:23:03 wlceventd: WLCEVENTD wlceventd_proc_event(386): eth5: Deauth_ind C8:2B:96:4F:17:96, status: 0, reason: Disassociated due to inactivity (4)
Mar 22 11:23:03 wlceventd: WLCEVENTD wlceventd_proc_event(401): eth5: Disassoc C8:2B:96:4F:17:96, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8)
Mar 22 11:23:13 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=194.26.29.112 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=245 ID=60691 PROTO=TCP SPT=40580 DPT=28889 SEQ=3597159604 ACK=0 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:23:17 kernel: DROP IN=eth0 OUT= MAC=04:d4:c4:c1:61:d0:c8:4c:75:76:f7:d9:08:00 SRC=172.105.13.242 DST=217.120.209.126 LEN=40 TOS=0x00 PREC=0x00 TTL=239 ID=54321 PROTO=TCP SPT=37096 DPT=10000 SEQ=3065391587 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 MARK=0x8000000
Mar 22 11:23:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) 2c:f4:32:e4:8b:7e
Mar 22 11:23:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.91 2c:f4:32:e4:8b:7e
Mar 22 11:23:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:b7:e4
Mar 22 11:23:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.105 c8:2b:96:4e:b7:e4
Mar 22 11:23:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4f:24:3a
Mar 22 11:23:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.20 c8:2b:96:4f:24:3a
Mar 22 11:23:21 dnsmasq-dhcp[974]: DHCPDISCOVER(br0) c8:2b:96:4e:df:6e
Mar 22 11:23:21 dnsmasq-dhcp[974]: DHCPOFFER(br0) 192.168.1.84 c8:2b:96:4e:df:6e
Mar 22 11:23:39 (SyslogEventMonitor.sh): 11101 v1.03 Syslog Event Monitor started.....
Mar 22 11:23:40 (SyslogEventMonitor.sh): 11101 Light Bulb Monitor Lightbulb DHCP detected c8:2b:96:4f:24:3a; Action='/jffs/scripts/Restart_Radio.sh'

status command showed the script as active:

Mar 22 11:21:17 (SyslogEventMonitor.sh): 10851 Syslog Event monitor ACTIVE

but lightbulbs only came up when I started it manually

Mar 22 11:23:39 (SyslogEventMonitor.sh): 11101 v1.03 Syslog Event Monitor started.....
Mar 22 11:23:40 (SyslogEventMonitor.sh): 11101 Light Bulb Monitor Lightbulb DHCP detected c8:2b:96:4f:24:3a;

but only after me starting the script did the lightbulbs come on. Any ideas?
Do I need to manually start this after every reboot?

Adam Popiel · Mar 22, 2020

or is it because of the 300second rule in the script and it would pick it up within 5 minutes?

Adam Popiel · Mar 22, 2020

Martineau said:
No need to donote to me personally, but... I know my instructions may seem useless, but in the future, if you do need to use anymore of my posts, please follow them correctly!!! - that will be enough.

they don't seem useless, I think I'm just useless

Adam Popiel · Mar 22, 2020

when it first said active it didn't contain the PID but after I started it and then did the status command I got the PID:

apopiel85@RT-AC86U-61D0:/tmp/home/root# cd /jffs/scripts/
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh status

grep: /tmp/SyslogEventMonitor.sh-running: No such file or directory
(SyslogEventMonitor.sh): 10851 Syslog Event monitor ACTIVE

apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh
(SyslogEventMonitor.sh): 11101 v1.03 Syslog Event Monitor started.....
(SyslogEventMonitor.sh): 11101 e-mail sent using curl smtps:// SSL/TLS (non-Certificate) mysmtp.server.com:nnn
./SyslogEventMonitor.sh: line 233: can't create : nonexistent directory
(Restart_Radio.sh): 11188 1.01 Restarting Radio.....

^C
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh status

(SyslogEventMonitor.sh): 12467 Syslog Event monitor ACTIVE PID=11101

apopiel85@RT-AC86U-61D0:/jffs/scripts#

Martineau · Mar 22, 2020

Adam Popiel said:
when it first said active it didn't contain the PID but after I started it and then did the status command I got the PID:

Code:

apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh status grep: /tmp/SyslogEventMonitor.sh-running: No such file or directory (SyslogEventMonitor.sh): 10851 Syslog Event monitor ACTIVE

Whoops

, you should patch the script to correctly interpret the reason for the 'missing' PID

e.g. v1.05 replace the 'status' clause:

Code:

if [ "$1" == "status" ];then
    if [ -n "$(ps -w | grep $(basename $0) | grep -v "grep $(basename $0)" | grep -v "status")" ];then     # v1.05
        echo -e $cBGRE
        if [ -f $LOCKFILE ];then                    # v1.05
            Say "$VER Syslog Event monitor ACTIVE" $(grep -oE "PID=[0-9]*" $LOCKFILE)
        else
            echo -e $cBYEL
            Say "$VER Syslog Event monitor termination pending....."        # v1.05
        fi
        echo -e $cRESET
        exit
    else
        echo -e $cBMAG
        Say "$VER Syslog Event monitor not running"
        echo -e $cRESET
        exit
    fi
fi

The script should self-regulate such that there is only ever one instance running, and the script should always (eventually) honour its 'stop' request.
However, to instantly terminate the script (possibly stalled termination?) you can always manually issue the following

Code:

kill -9 "$(pidof SyslogEventMonitor.sh)"

Adam Popiel said:
Do I need to manually start this after every reboot?

Yes, as per post #26 using services-start script.

Adam Popiel · Mar 22, 2020

@Martineau

Ok so after our apparent success I've moved to other thing to do in my house (wife 2 kids). Now about an hour ago I get back on my laptop and noticed that it wasn't detecting the DHCP trigger anymore. I've came here and noticed post #37 so I went into the script and edited it there, still nothing. Since I did so many things already on this FW I decided to do a factory reset with backup of the jffs partition. After doing the reset I restored my jffs partition. Ive chmod both the SyslogEventMonitor.sh and Restart_Radio.sh scripts. the good news is that the trigger works and I can terminate the script.
--------------------------------------------------------------------------------------------
apopiel85@RT-AC86U-61D0:/jffs/scripts# ./SyslogEventMonitor.sh stop

(SyslogEventMonitor.sh): 7269 Syslog Event monitor Termination requested

apopiel85@RT-AC86U-61D0:/jffs/scripts# (SyslogEventMonitor.sh): 6481 Syslog Event Monitor external termination trigger.....terminating
------------------------------------------------------------------------------------------------------------

The bad news it looks like it stopped working other than triggering for one MAC address.

Mar 22 21:26:14 (SyslogEventMonitor.sh): 7356 Light Bulb Monitor Lightbulb DHCP detected c8:2b:96:4f:24:3a; Action='/jffs/scripts/Restart_Radio.sh'
Mar 22 21:26:14 (SyslogEventMonitor.sh): 7356 e-mail sent using curl smtps:// SSL/TLS (non-Certificate) mysmtp.server.com:nnn
Mar 22 21:26:14 (Restart_Radio.sh): 8397 1.01 Restarting Radio.....

Mar 22 21:39:51 (SyslogEventMonitor.sh): 7356 Light Bulb Monitor Lightbulb DHCP detected c8:2b:96:4f:24:3a; Action='/jffs/scripts/Restart_Radio.sh'
Mar 22 21:39:51 (SyslogEventMonitor.sh): 7356 e-mail sent using curl smtps:// SSL/TLS (non-Certificate) mysmtp.server.com:nnn
Mar 22 21:39:51 (Restart_Radio.sh): 12097 1.01 Restarting Radio.....

---------------------------------------------------------------------------------------------------------------------------------

When I take out this lightbulb the others don't get discovered even tho the script is running:

Mar 22 23:25:19 is the instance that I plug some lightbulbs in but not c8:2b:96:4f:24:3a specifically to test and even after over 5 minutes (300s) waiting the script didn't initiate

Im attaching the complete logs from the factory reboot and the script,

Thanks once again

Adam Popiel · Mar 22, 2020

addming more informaion
what i noticed just now is that once i stop the script, wl radio off && wl radio on, then as usual lightbulbs get discovered fully and then when i start the script it finds that 1 blighbult i mentioned above and restarts the radio on the dhcp trigger only:

Mar 22 23:48:56 dnsmasq-dhcp[946]: DHCPDISCOVER(br0) c8:2b:96:4f:24:3a
Mar 22 23:48:56 dnsmasq-dhcp[946]: DHCPOFFER(br0) 192.168.1.20 c8:2b:96:4f:24:3a
Mar 22 23:48:56 dnsmasq-dhcp[946]: DHCPREQUEST(br0) 192.168.1.20 c8:2b:96:4f:24:3a
Mar 22 23:48:56 dnsmasq-dhcp[946]: DHCPACK(br0) 192.168.1.20 c8:2b:96:4f:24:3a ZENGGE_35_4F243A
Mar 22 22:50:18 dropbear[30194]: Child connection from 222.186.31.166:28541
Mar 22 22:50:19 dropbear[30194]: Exit before auth: Disconnect received
Mar 22 22:51:32 dropbear[30311]: Child connection from 222.186.42.75:39160
Mar 22 22:51:33 dropbear[30311]: Exit before auth: Disconnect received
Mar 22 22:54:20 (SyslogEventMonitor.sh): 30571 v1.03 Syslog Event Monitor started.....
Mar 22 22:54:21 (SyslogEventMonitor.sh): 30571 Light Bulb Monitor Lightbulb DHCP detected c8:2b:96:4f:24:3a; Action='/jffs/scripts/Restart_Radio.sh'
Mar 22 22:54:21 (SyslogEventMonitor.sh): 30571 e-mail sent using curl smtps:// SSL/TLS (non-Certificate) mysmtp.server.com:nnn
Mar 22 22:54:21 (Restart_Radio.sh): 30635 1.01 Restarting Radio.....

logs attached

Martineau · Mar 22, 2020

Adam Popiel said:
when i start the script it finds that 1 blighbult i mentioned above and restarts the radio on the dhcp trigger only:

Code:

Mar 22 22:54:20 (SyslogEventMonitor.sh): 30571 v1.03 Syslog Event Monitor started..... Mar 22 22:54:21 (SyslogEventMonitor.sh): 30571 Light Bulb Monitor Lightbulb DHCP detected c8:2b:96:4f:24:3a; Action='/jffs/scripts/Restart_Radio.sh'

Notice anything significant where text string "c8:2b:96:4f:24:3a" appears in the variable MAC_LIST ?

The script that was working doesn't have spaces in the variable MAC_LIST, but now you are asking for a text match ONLY when there is an extra space after the MAC...…... except for the very last one.

Remove ALL spaces you have recently inserted into the variable MAC_LIST

Thread starter	Title	Forum	Replies	Date
D	Help me with remote access to my router	Asuswrt-Merlin	12	Yesterday at 7:02 AM
R	Open VPN per client configuration router help	Asuswrt-Merlin	10	Feb 9, 2025
M	Frimware Broke Router - 2.4ghz now showing channels 1 - 14; both wifi 5 showing 36 - 165. Help!	Asuswrt-Merlin	21	Jan 21, 2025
	Router to Router Routing help	Asuswrt-Merlin	11	Dec 27, 2024
	Please help me diagnose knotty routing problem	Asuswrt-Merlin	4	Nov 14, 2024
T	[Help] Problems setting up OpenVPN	Asuswrt-Merlin	7	Oct 16, 2024
	Need help with Namecheap -> Router -> Caddy	Asuswrt-Merlin	10	Oct 15, 2024
P	Asus aimesh node disconnects frequently, corresponding log entries recorded. Need help understanding the log.	Asuswrt-Merlin	5	Aug 22, 2024
V	Asus RT-AX3000 Help	Asuswrt-Merlin	5	Aug 21, 2024
	Need help configuring NextDNS	Asuswrt-Merlin	21	Aug 18, 2024

Help with writing a simple "wl radio off && wl radio on" script!! please!!

Part of the Furniture

Part of the Furniture

Part of the Furniture

Occasional Visitor

Attachments

Occasional Visitor

Part of the Furniture

Occasional Visitor

Occasional Visitor

Occasional Visitor

Occasional Visitor

Occasional Visitor

Part of the Furniture

Occasional Visitor

Occasional Visitor

Occasional Visitor

Occasional Visitor

Part of the Furniture

Occasional Visitor

Attachments

Occasional Visitor

Attachments

Part of the Furniture

Similar threads

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest