How to clear/delete syslog entries

[smcgrath12]

I have 380.59 on AC-68R. I am trying to clean entries in the system log. From my reading, the Web UI only clears the UI, but not the actual log entries.

Next, I tried running rm /tmp/syslog.log and it does delete the file, but after reboot the log is recreated and all the old entries come back... I think I saw that behavior, but I could be wrong.

Next, I tried deleting the /tmp/syslog.log file along with /jffs/syslog.log files as well. Rebooted the router, but that does not help either. In fact, now I see log entries for varied dates commingled. Obviously I have done something very wrong.

Next, I cleaned all data in the previous two files, but that doesn't seem to help either.

I also tried finding the syslogd service PID by using "cat /var/run/syslogd.pid 2> /dev/null". Next, I ran "/bin/kill -HUP PID" (where PID came from the previous command). Then, I deleted the previous 2 files. But no joy.

Can someone list steps on how to clear all log entries along with any proper sequencing of router reboots to do this? The reason for clearing log entries is that my logs have filled up with DHCP back and forth entries for wireless clients because I did not enable the "Hide DHCP/RA queries" option. Now that my logs entries are really messed up, I would like to start clean. Thanks for your help.

 

[john9527]

You also need to get the syslog.log-1 files....

rm /tmp/syslog.*
rm /jffs/syslog.*

 

[smcgrath12]

You also need to get the syslog.log-1 files....

rm /tmp/syslog.*
rm /jffs/syslog.*

Yes, I did that as well, I should have listed that step in my Q. But that did not help.

 

[ColinTaylor]

# killall syslogd
# sync
# rm /tmp/syslog.log*
# rm /jffs/syslog.log*
# sync
# reboot

 

[sfx2000]

I am trying to clean entries in the system log.

Something to hide?

Just saying...

 

[Fitz Mutch]

# rm /jffs/syslog.log*

Just a heads up. If you dump the JFFS area, you will see the deleted syslog.log file there. Copy a large file to JFFS. It will fill up the empty space and overwrite the data from any deleted files.

Also, the /tmp folder is held in RAM. Just power off the router to erase it.

 

[smcgrath12]

# killall syslogd
# sync
# rm /tmp/syslog.log*
# rm /jffs/syslog.log*
# sync
# reboot

I ran the commands. It seems to have cleared all entries before today, but there are many entries from July of last year (just one day). After those historical entries, the correct entries since my last reboot (after running the commands you showed) show up. But those July entries will not go away.

I ran the commands twice just to make sure, but those historical entries are still there! Any ideas?

 

[smcgrath12]

Just a heads up. If you dump the JFFS area, you will see the deleted syslog.log file there. Copy a large file to JFFS. It will fill up the empty space and overwrite the data from any deleted files.

Also, the /tmp folder is held in RAM. Just power off the router to erase it.

Can you explain what you mean by empty space? Not sure what kind of file I need to write or what size? I am lost here...

 

[john9527]

I ran the commands. It seems to have cleared all entries before today, but there are many entries from July of last year (just one day). After those historical entries, the correct entries since my last reboot (after running the commands you showed) show up. But those July entries will not go away.

I ran the commands twice just to make sure, but those historical entries are still there! Any ideas?

Those are expected and are new entries....the router has no real time clock so on a reboot a default time is set until the router sets the time with ntp.

 

[smcgrath12]

Those are expected and are new entries....the router has no real time clock so on a reboot a default time is set until the router sets the time with ntp.

Ha! That clears my confusion.. Thanks for the explanation.

 

[Fitz Mutch]

Can you explain what you mean by empty space? Not sure what kind of file I need to write or what size? I am lost here...

If there's no secure delete program, just delete the file as usual then copy any files (< 64MB) to JFFS until it says out of space on device, then delete them. I had an issue where I accidentally logged a secret password to the JFFS syslog, and I didn't want it just sitting there in unclaimed space, waiting for it to be overwritten by another file. Also, you could probably backup/reformat/restore JFFS, that might accomplish the same thing.