NVRAM Disappeared Overnight

[bozolino]

when i woke up this morning, none of my smart home devices worked. i found it was my router's fault. the dnsmasq tables were empty, so were the ovpn keys. restoring from a nvram backup fixed the problem. but i would like to know what caused the nvram content to "disappear" overnight. i have scribe installed, so all the logs are available. if somebody on the forum can please tell me which logfiles to post, maybe there's a way to find the culprit? best, manu

 

[bozolino]

The current space values were:
NVRAM usage 77057 / 131072 bytes
JFFS 47.28 / 48.00 MB

The main space hogs in /jffs/.sys:
4,5MB WebHistory.db
12,3MB nt_center.db
28,4MB TrafficAnalyzer.db-journal
31,5MB TrafficAnalyzer.db

I've checked the traffic analyzer "Statistic" page, and it showed no data/clients. Maybe the data files were full & garbled? After deleting TrafficAnalyzer.db*, the "statistic" page started being populated with client data again. So maybe this was the problem?

 

[Adamm]

The current space values were:
NVRAM usage 77057 / 131072 bytes
JFFS 47.28 / 48.00 MB

The main space hogs in /jffs/.sys:
4,5MB WebHistory.db
12,3MB nt_center.db
28,4MB TrafficAnalyzer.db-journal
31,5MB TrafficAnalyzer.db

I've checked the traffic analyzer "Statistic" page, and it showed no data/clients. Maybe the data files were full & garbled? After deleting TrafficAnalyzer.db*, the "statistic" page started being populated with client data again. So maybe this was the problem?

Various settings are stored in /jffs/nvram and /jffs/openvpn due to space limitations, so its very possible that they were nuked by accident when the system was trying to write the logs above.

skynet@RT-AX88U-DC28:/jffs/nvram# ls
MULTIFILTER_DEVICENAME         custom_usericon                keyword_sched                  qos_rulelist                   wl0_maclist_x                  wl1_maclist_x                  wl_rast_static_client
MULTIFILTER_MACFILTER_DAYTIME  dhcp_hostnames                 lb_skip_port                   sr_rulelist                    wl0_rast_static_client         wl1_rast_static_client         wl_sched
asus_device_list               dhcp_staticlist                nc_setting_conf                sshd_authkeys                  wl0_sched                      wl1_sched
custom_clientlist              fb_comment                     qos_orates                     url_sched                      wl1_chansps                    wl_maclist_x

skynet@RT-AX88U-DC28:/jffs/openvpn# ls
vpn_crt_client1_ca          vpn_crt_client2_ca          vpn_crt_server1_ca          vpn_crt_server1_client_crt  vpn_crt_server1_crt         vpn_crt_server1_key
vpn_crt_client1_crl         vpn_crt_client2_crl         vpn_crt_server1_ca_key      vpn_crt_server1_client_key  vpn_crt_server1_dh          vpn_crt_server1_static

 

[st3v3n]

bozolino; Same type of issue happened, couldn't track it down so chalked it up to Halloween spooks. Adamm is right on, cheers.

 

[gattaca]

Hmm I'm seeing the same thing and freaking out a bit..

:/tmp/home/root# df -h
Filesystem Size Used Available Use% Mounted on
ubi:rootfs_ubifs 77.2M 63.5M 13.6M 82% /
devtmpfs 214.9M 0 214.9M 0% /dev
tmpfs 215.0M 364.0K 214.7M 0% /var
mtd:bootfs 4.4M 3.3M 1.1M 75% /bootfs
mtd:data 8.0M 708.0K 7.3M 9% /data
tmpfs 215.0M 1.4M 213.7M 1% /tmp
/dev/mtdblock8 48.0M 47.4M 620.0K 99% /jffs
/dev/mtdblock8 48.0M 47.4M 620.0K 99% /www/Feedback_Info.asp
/dev/mtdblock8 48.0M 47.4M 620.0K 99% /www/AdaptiveQoS_ROG.asp
/dev/mtdblock8 48.0M 47.4M 620.0K 99% /www/state.js
/dev/mtdblock8 48.0M 47.4M 620.0K 99% /www/Advanced_MultiSubnet_Content.asp
/dev/mtdblock8 48.0M 47.4M 620.0K 99% /www/Advanced_Feedback.asp
/dev/mtdblock8 48.0M 47.4M 620.0K 99% /www/require/modules/menuTree.js
/dev/mtdblock8 48.0M 47.4M 620.0K 99% /www/start_apply.htm
/dev/sda 58.4G 2.3G 53.1G 4% /tmp/mnt/1122-ASUS-AC86U

 

[gattaca]

OK based on above post, I found the /jffs/.sys/TrafficAnalyzer/TrafficAnal* files were HUGE... I blew them away. Not sure the implications but this felt a bit urgent.

Does anyone know WTH is making those file get that large or why they are not pruning themselves?

/jffs/.sys/TrafficAnalyzer# ls -lrt
-rw-rw-rw- 1 admi root 30981152 Nov 1 20:13 TrafficAnalyzer.db-journal
-rw-rw-rw- 1 admi root 31461376 Nov 2 19:36 TrafficAnalyzer.db
admin@1122-11107-AC86:/jffs/.sys/TrafficAnalyzer# rm TrafficAnalyzer.db*
admin@1122-11107-AC86:/jffs/.sys/TrafficAnalyzer# ls
admin@1122-11107-AC86:/jffs/.sys/TrafficAnalyzer# df -h
Filesystem Size Used Available Use% Mounted on
ubi:rootfs_ubifs 77.2M 63.5M 13.6M 82% /
devtmpfs 214.9M 0 214.9M 0% /dev
tmpfs 215.0M 364.0K 214.7M 0% /var
mtd:bootfs 4.4M 3.3M 1.1M 75% /bootfs
mtd:data 8.0M 708.0K 7.3M 9% /data
tmpfs 215.0M 1.4M 213.6M 1% /tmp
/dev/mtdblock8 48.0M 6.4M 41.6M 13% /jffs
/dev/mtdblock8 48.0M 6.4M 41.6M 13% /www/Feedback_Info.asp
/dev/mtdblock8 48.0M 6.4M 41.6M 13% /www/AdaptiveQoS_ROG.asp
/dev/mtdblock8 48.0M 6.4M 41.6M 13% /www/state.js
/dev/mtdblock8 48.0M 6.4M 41.6M 13% /www/Advanced_MultiSubnet_Content.asp
/dev/mtdblock8 48.0M 6.4M 41.6M 13% /www/Advanced_Feedback.asp
/dev/mtdblock8 48.0M 6.4M 41.6M 13% /www/require/modules/menuTree.js
/dev/mtdblock8 48.0M 6.4M 41.6M 13% /www/start_apply.htm
/dev/sda 58.4G 2.3G 53.1G 4% /tmp/mnt/1122-ASUS-AC86U

 

[cmkelley]

OK based on above post, I found the /jffs/.sys/TrafficAnalyzer/TrafficAnal* files were HUGE... I blew them away. Not sure the implications but this felt a bit urgent.

Does anyone know WTH is making those file get that large or why they are not pruning themselves?

/jffs/.sys/TrafficAnalyzer# ls -lrt
-rw-rw-rw-    1 gcm-admi root      30981152 Nov  1 20:13 TrafficAnalyzer.db-journal
-rw-rw-rw-    1 gcm-admi root      31461376 Nov  2 19:36 TrafficAnalyzer.db
gcm-admin@3622-11107-AC86:/jffs/.sys/TrafficAnalyzer# rm TrafficAnalyzer.db*
gcm-admin@3622-11107-AC86:/jffs/.sys/TrafficAnalyzer# ls
gcm-admin@3622-11107-AC86:/jffs/.sys/TrafficAnalyzer# df -h
Filesystem                Size      Used Available Use% Mounted on
ubi:rootfs_ubifs         77.2M     63.5M     13.6M  82% /
devtmpfs                214.9M         0    214.9M   0% /dev
tmpfs                   215.0M    364.0K    214.7M   0% /var
mtd:bootfs                4.4M      3.3M      1.1M  75% /bootfs
mtd:data                  8.0M    708.0K      7.3M   9% /data
tmpfs                   215.0M      1.4M    213.6M   1% /tmp
/dev/mtdblock8           48.0M      6.4M     41.6M  13% /jffs
/dev/mtdblock8           48.0M      6.4M     41.6M  13% /www/Feedback_Info.asp
/dev/mtdblock8           48.0M      6.4M     41.6M  13% /www/AdaptiveQoS_ROG.asp
/dev/mtdblock8           48.0M      6.4M     41.6M  13% /www/state.js
/dev/mtdblock8           48.0M      6.4M     41.6M  13% /www/Advanced_MultiSubnet_Content.asp
/dev/mtdblock8           48.0M      6.4M     41.6M  13% /www/Advanced_Feedback.asp
/dev/mtdblock8           48.0M      6.4M     41.6M  13% /www/require/modules/menuTree.js
/dev/mtdblock8           48.0M      6.4M     41.6M  13% /www/start_apply.htm
/dev/sda                 58.4G      2.3G     53.1G   4% /tmp/mnt/1122-ASUS-AC86U

That's still weird. I have way more free space on jffs than that ...

Filesystem                Size      Used Available Use% Mounted on
ubi:rootfs_ubifs         77.2M     63.5M     13.6M  82% /
devtmpfs                214.9M         0    214.9M   0% /dev
tmpfs                   215.0M      1.5M    213.5M   1% /var
mtd:bootfs                4.4M      3.3M      1.1M  75% /bootfs
mtd:data                  8.0M    640.0K      7.4M   8% /data
tmpfs                   215.0M      1.3M    213.7M   1% /tmp
/dev/mtdblock8           48.0M     21.6M     26.4M  45% /jffs
/dev/mtdblock8           48.0M     21.6M     26.4M  45% /www/Feedback_Info.asp
/dev/mtdblock8           48.0M     21.6M     26.4M  45% /www/Advanced_Feedback.asp
/dev/mtdblock8           48.0M     21.6M     26.4M  45% /www/Advanced_MultiSubnet_Content.asp
/dev/mtdblock8           48.0M     21.6M     26.4M  45% /www/require/modules/menuTree.js
/dev/mtdblock8           48.0M     21.6M     26.4M  45% /www/start_apply.htm
/dev/sda1               109.9G      1.0G    103.3G   1% /tmp/mnt/usbssd
/dev/mtdblock8           48.0M     21.6M     26.4M  45% /www/Main_LogStatus_Content.asp

 

[RMerlin]

The Traffic Analyzer db is managed to get truncated to a max of 30 MB. But I don't know why there's also a journal file that's just as big.

 

[gattaca]

The Traffic Analyzer db is managed to get truncated to a max of 30 MB. But I don't know why there's also a journal file that's just as big.

If this helps, neither of these files shrunk in size when I restarted the router. That was the first thing I tried before blowing them away. As I recall, the router had been up about 61 days then and is running your latest publically released firmware 384.13 + amtm (2.7 at that time) now 2.9.

If I turn off the TrafficAnalyzer, what do I lose, if anything important?

-rw-rw-rw- 1 admi root 30981152 Nov 1 20:13 TrafficAnalyzer.db-journal
-rw-rw-rw- 1 admi root 31461376 Nov 2 19:36 TrafficAnalyzer.db

 

[RMerlin]

If this helps, neither of these files shrunk in size when I restarted the router. That was the first thing I tried before blowing them away. As I recall, the router had been up about 61 days then and is running your latest publically released firmware 384.13 + amtm (2.7 at that time) now 2.9.

If I turn off the TrafficAnalyzer, what do I lose, if anything important?

-rw-rw-rw- 1 admi root 30981152 Nov 1 20:13 TrafficAnalyzer.db-journal
-rw-rw-rw- 1 admi root 31461376 Nov 2 19:36 TrafficAnalyzer.db

The size didn't drop because you are within the established limit of 30 MB. The database size gets checked every hour (unless that has changed), no reboot required.

You will only lose the Traffic Analyzer data itself. You could turn it off, delete the database, and turn it back on to completely reinitialize it.

 

[gattaca]

^^^ ....but the journal should not be 30MB too? Typically file journals are smaller than the DB they front.
I've logged in many times in the past two years and never caught the /jffs at 99% so I'm not sure either what's up.
Thanks.

 

[RMerlin]

^^^ ....but the journal should not be 30MB too? Typically file journals are smaller than the DB they front.
I've logged in many times in the past two years and never caught the /jffs at 99% so I'm not sure either what's up.
Thanks.

Probably not. But I'm not familiar with sqlite, so I don't know what should be normal for the journal.

 

[gattaca]

^^^ Thanks. I'll poke around and turn off the network stats..