/jffs/syslog?

[labro]

Hello,
I recently upgrade to a AC87U (if you can call it an upgrade), and interestingly I noticed that /jffs/ was being used by syslog files. If I recall, the /jffs/ partition was meant for infrequent writes so I'd like to turn this off if possible. I heard that /jffs/ syslog storage being enabled for debug builds but I am on 378.56_2.

Any input on this would be great.

Thanks.

 

[joegreat]

/jffs/syslog?

Yes, /jffs/syslog!

Was changed by Asus sometime ago to preserve the syslog between reboots.

 

[PolarBear]

Yes, /jffs/syslog!

Was changed by Asus sometime ago to preserve the syslog between reboots.

It's good that the syslog survives a reboot, but not if it will cause premature wear and shorten the lifespan of the router.

Would it be possible to write the syslog to a USB stick instead ?

I suppose it would need some sort of script which runs after everything has finished loading, copies the syslog with the start up entries from jffs to the stick, then somehow changes the location to which any further entries are written.

I'm not sure if this would be possible ?

 

[Martineau]

It's good that the syslog survives a reboot, but not if it will cause premature wear and shorten the lifespan of the router.

Would it be possible to write the syslog to a USB stick instead ?

I suppose it would need some sort of script which runs after everything has finished loading, copies the syslog with the start up entries from jffs to the stick, then somehow changes the location to which any further entries are written.

I'm not sure if this would be possible ?

http://www.snbforums.com/threads/keep-more-of-syslog.25356/#post-188686

 

[RMerlin]

Their recent routers use a flash chip that's rated for over 10,000 writes. That SKU is specifically designed for log storage.

 

[labro]

I removed permissions to write to those files which probably breaks untold things. My writes are significantly higher because I log firewall output - I have a Kibana instance I use to visualize. But these are written quite more often then a daily export. I already log my logs to a syslog server so turning this off would just be cleaner.

So after some investigating its in /sbin/rc. No easy way to modify this without recompile at the very least

 

[RMerlin]

I removed permissions to write to those files which probably breaks untold things. My writes are significantly higher because I log firewall output - I have a Kibana instance I use to visualize. But these are written quite more often then a daily export. I already log my logs to a syslog server so turning this off would just be cleaner.

So after some investigating its in /sbin/rc. No easy way to modify this without recompile at the very least

Preventing writing to it is fine. For about a month, my RT-AC88U was running a wireless driver with debug logging enabled ,which generated a LOT of logging. What I did was simply to delete /jffs/syslog and syslog-1, and create two empty directories of that name. That was enough to prevent the copy to jffs, and keep logging in RAM.

 

[Etz]

Their recent routers use a flash chip that's rated for over 10,000 writes. That SKU is specifically designed for log storage.

But RT-AC68U is not quite recent, still it stores syslog to jffs...

drwxr-xr-x    2 admin    root             0 Nov 26 12:31 configs
drwxr-xr-x    2 admin    root             0 Dec 11 21:44 scripts
-rw-rw-rw-    1 admin    root        249946 Nov 25 23:18 syslog.log
-rw-rw-rw-    1 admin    root        262171 Nov 25 23:18 syslog.log-1
-rw-r--r--    1 admin    root             0 Dec 11 21:29 traffic.db
drwxr-xr-x    2 admin    root             0 Dec 10 22:22 usericon

I wonder how long will that chip last this way, of course it is nice to have persistent syslog, but still...

Would it be possible to write the syslog to a USB stick instead ?

Symlink?
But you probably would lost part of it, during boot, untill USB disk gets mounted...

 

[RMerlin]

But RT-AC68U is not quite recent, still it stores syslog to jffs...

By recent, I meant starting with the RT-AC66U (which was when routers went from the old 32 MB flash to the newer 128 MB flash).

 

[labro]

Perfect! Glad to hear it doesn't cause any negative side effects.

 

[mstombs]

Their recent routers use a flash chip that's rated for over 10,000 writes. That SKU is specifically designed for log storage.

I hope it is a lot bigger number than that! When I last looked at the code Asus do not log directly to flash, they log to tmp ram disk and only copy on a timer once a minute if it has grown. jffs knows all about wear levelling write caches to only write whole erase blocks (64kB?) and having a large jffs disk means writes to individual blocks are minimized. But this does mean latest log messages are lost on a crash/reboot - much better to use a remote rsyslog device where each message is broadcast by udp when they occur.

Also have Asus fixed the bug which also greatly reduces flash writes, which means the syslog on jffs is only the largest one seen? How recent are messages on the flash copy? If this is the current active code then I don't think so!

https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/rc/watchdog.c#L2299

 

[kvic]

much better to use a remote rsyslog device where each message is broadcast by udp when they occur.

When there is a second device/server available, that's indeed one good option.

I replace syslog with syslog-ng from Entware, and log all messages to the Entware partition. So all messages are always persisted. Another advantage is I'm able to filter messages into different log files and also discard "junk messages" which aren't needed.