Log file on JFFS?

[fulcsa]

Merlin wrote:

I do not recommend doing frequent writes to this area, as it will
prematuraly wear out the flash storage. This is a good place to put
files that are written once like scripts or kernel modules, or that
rarely get written to (like once a day). Storing files that constantly
get written to (like logfiles) is NOT recommended - use a USB disk for
that.

After i flashed Merlin fw to RT-AC56U i saw that there is a log file creating on JFFS too.
I didnt set log to JFFS, becouse i read Merlin's warning.
Can someone confirm that there is something strange happening on RT-AC56U or this problem is only at me?
Again, I didn't set log to JFFS through web UI or SSH.

 

[thelonelycoder]

Check setting in Tools / Other Settings
If it is not pointing to /jffs/ then your router is truly giving you a hard time...

 

[fulcsa]

In Tools / Other Settings you can set only the log file place of Traffic Monitoring.
Here is my settings:

Yes, I use traffic monitoring as you can see, but System Log and Traffic Monitoring log are not the same. Anyway I didn't find settings for "place of System log" in web UI.

After a fresh restart i see this with mc:

 

[Adamm]

In Tools / Other Settings you can set only the log file place of Traffic Monitoring.
Here is my settings:

Yes, I use traffic monitoring as you can see, but System Log and Traffic Monitoring log are not the same. Anyway I didn't find settings for "place of System log" in web UI.

After a fresh restart i see this with mc:

I think the first thing you should have done was use the search feature, if you did you would have been directed to a post by Merlin that states that the JFFS partition has almost twice the lifespan of a traditional SSD (not sure the exact number of write cycles). Asus knew what they were doing and the log file should not ware out the JFFS partition.

/rant

 

[fulcsa]

... Asus knew what they were doing and the log file should not ware out the JFFS partition.

/rant

Hmmm, strange. Maybe you are right, but after i did the search you recomended for me i found the same thing that i already wrote here.
Here is the link: https://github.com/RMerl/asuswrt-merlin/wiki/JFFS
And this is what Merlin wrote there:

I do not recommend doing frequent writes to this area, as it will prematurely wear out the flash RAM. This is a good place to put files that are written once like scripts or kernel modules, or that rarely get written to. Do not put files that get constantly written to (such as logfiles) - store these on a USB disk instead. Replacing a worn out USB flash disk is much cheaper than replacing the whole router if flash sectors get worn out - they have a limited number of write cycles.

 

[fulcsa]

OK, i found another info from Merlin too. So i'm a bit confused now.
Here is the link: https://github.com/RMerl/asuswrt-merlin/issues/519

And Merlin words:

I just dug out the specs for the flash used in the RT-AC66U - that chip is rated for 100,000 write cycles, and is in fact designed for intensive write usage. Combine that with JFFS2's wear leveling, over 32 MB of flash space, and you're looking at a a few decades of write cycles before you will run into any issue. Just for sake of argument, let's say you write 1MB of syslog every day (which is a lot). Spread over 32 MB = 32 days before you will have written over the whole flash. Multiplied by 100,000 write cycles? You will be dead and buried before your flash wears out...

Asus's engineers knew what they were doing when they enabled this by default. It's fine. This isn't a high performance SSD with only 4000 write cycles.

 

[thelonelycoder]

It seems to write two syslogs. Do they show the same content?
And what happens if you delete the one on jffs?

 

[Adamm]

I believe the log file is written to both /tmp and backed up to /jffs. The reason for this being (to my knowledge) so that the logs are persistent after a reboot (everything outside of /jffs is wiped on reboot)

 

[thelonelycoder]

This may be a Merlin thing. It writes a delayed backup of both syslog.log* to jffs. Seems OK and a goot thing by me

 

[RMerlin]

This may be a Merlin thing. It writes a delayed backup of both syslog.log* to jffs. Seems OK and a goot thing by me

No, this was done by Asus a few months ago.

 

[fulcsa]

Then, everything I asked answered.
I accept that Asus use JFFS as a backup storage for Syslog.

Thank you for all your feedbacks/posts.
Thank you Merlin for your great firmware mod.

 

[misteradrian]

I send all my logs to Splunk, so there is no need for one to fillup the JFFS with syslogs..... It appears what is going on is some process is copying the files from /tmp to /jffs... I added this to my services-startup and it seems to work. The -R points to my internal splunk box....

/usr/bin/killall syslogd
/sbin/syslogd -m 60 -S -s 128 -l 1 -R 10.0.0.14:514 -L &

 

[Hello World]

I send all my logs to Splunk, so there is no need for one to fillup the JFFS with syslogs..... It appears what is going on is some process is copying the files from /tmp to /jffs... I added this to my services-startup and it seems to work. The -R points to my internal splunk box....

/usr/bin/killall syslogd
/sbin/syslogd -m 60 -S -s 128 -l 1 -R 10.0.0.14:514 -L &

Does this still work with Splunk? I cant get my ASUS router to send the sylogs to splunk. I'm batting zero.