Scribe Scribe 2.4.4 is out

[cmkelley]

@visortgw thanks for checking. Glad it wasn’t something I did!
@cmkelley - any ideas on how to get the syslog.logs back?

Yeah, I'll have to dig into it, and refamiliarize myself with how this all works. Is it just the 388 codebase? i.e. did it work on AX routers running the 386 codebase?

 

[JGrana]

Yeah, I'll have to dig into it, and refamiliarize myself with how this all works. Is it just the 388 codebase? i.e. did it work on AX routers running the 386 codebase?

Yes, it’s an AX88U Pro running 388.2 Beta 1.
I do recall it working on an AX88U running 386.

Thanks. I’m happy to test anything you want to try

 

[elorimer]

Isn't this by design, from way, way back?

Once you install scribe, the syslog.log becomes /opt/var/log/messages. There isn't any further need for syslog.log itself. But the AsusWrt firmware will continue unnecessarily to copy /tmp/syslog.log to /jffs/syslog.log and the spillover -1. The way to prevent that is to make /jffs/syslog.log a directory instead.

This may be unnecessary now though. From the wiki:

I do not recommend doing frequent writes to this area, as it may prematurely wear out the flash chip. This is a good place to put files that are written once like scripts or kernel modules, or that rarely get written to. Do not put files that get constantly written to (such as high activity logfiles) - store these on a USB disk instead. Replacing a worn out USB flash disk is much cheaper than replacing the whole router if flash sectors get worn out.

Asus routers produced since the RT-AC68U use high endurance flash memory rated for 100,000 Program/Erase cycles so wear should not be an issue for most applications. Current Asus firmware now uses the JFFS partition to store not only logfiles but databases and other frequently updated information.

 

[JGrana]

It does make sense. I do have directories created (not sure by who). In looking through the scribe code, the only directories created are the share directories for the example filters.

Must be something new in 388? By design as you said.

Not totally against this strategy. The less writes to /jffs the better. The syslog-ng filters are nice and I can always use dmesg to catch the early boot process.

I might try to change the link from /jffs to my USB drive.

 

[JGrana]

Just replaced the symlink /tmp/syslog.log to point to a syslog.log file on my USB drive.
Did a logger “Did this work”
No write to the USB file - but does show up in /opt/var/log/messages.
Ill change the link back and leave well enough alone ;-)

 

[elorimer]

It does make sense. I do have directories created (not sure by who). In looking through the scribe code, the only directories created are the share directories for the example filters.

It is part of the syslog-ng start in /opt/etc/init.d/rc.func.syslog-ng:

   # make /jffs/syslog.log and log-1 directories if not already
    # prevents system log saver from writing to jffs
    if [ ! -d "/jffs/syslog.log" ] || [ ! -d "/jffs/syslog.log-1" ]
    then
        rm -rf /jffs/syslog.log /jffs/syslog.log-1
        mkdir /jffs/syslog.log /jffs/syslog.log-1
    fi

Dates from at least 6 years ago: https://www.snbforums.com/threads/configuring-syslog-ng-with-merlin-firmware.35095/post-284423

Or maybe 8 years ago: https://www.snbforums.com/threads/jffs-syslog.29073/

 

[cmkelley]

It is part of the syslog-ng start in /opt/etc/init.d/rc.func.syslog-ng:

   # make /jffs/syslog.log and log-1 directories if not already
    # prevents system log saver from writing to jffs
    if [ ! -d "/jffs/syslog.log" ] || [ ! -d "/jffs/syslog.log-1" ]
    then
        rm -rf /jffs/syslog.log /jffs/syslog.log-1
        mkdir /jffs/syslog.log /jffs/syslog.log-1
    fi

Dates from at least 6 years ago: https://www.snbforums.com/threads/configuring-syslog-ng-with-merlin-firmware.35095/post-284423

Or maybe 8 years ago: https://www.snbforums.com/threads/jffs-syslog.29073/

Yeah, that's where I'm going to have to detect where the system is looking and fix it accordingly.

Sadly, it's not as simple as 388 vs. 386 per RMerlin, so it looks like Adamm's solution is going to have to be it. I may not be able to get to it until this weekend though, there continues to be far too much B***S*** in my life. :-(

 

[visortgw]

Yeah, that's where I'm going to have to detect where the system is looking and fix it accordingly.

Sadly, it's not as simple as 388 vs. 386 per RMerlin, so it looks like Adamm's solution is going to have to be it. I may not be able to get to it until this weekend though, there continues to be far too much B***S*** in my life. :-(

I'd be more than willing to test any updates on GT-AX6000 running latest Merlin 388.2 beta1 firmware.

Thanks again for your ongoing support. Sorry to hear about the BS in your life as I feel the same pain in my life.

 

[JGrana]

I'd be more than willing to test any updates on GT-AX6000 running latest Merlin 388.2 beta1 firmware.

Thanks again for your ongoing support. Sorry to hear about the BS in your life as I feel the same pain in my life.

@cmkelley , I echo @visortgw . No worries and good luck with the BS.

Thanks again for making scribe!

 

[elorimer]

Yeah, that's where I'm going to have to detect where the system is looking and fix it accordingly.

I'm not clear anything needs to be "fixed" or what is different now. I've got an AC86 on 386.10 and an AX88 on 388.2b1.

 

[elorimer]

The syslog-ng filters are nice and I can always use dmesg to catch the early boot process.

Scribe captures the early boot process. rc.func.syslog-ng copies /jffs/syslog.log to messages before it deletes it and converts it into a directory.

Also, it isn't hard to fiddle with that to copy syslog.log to a file, and use that file as the first source to be processed after syslog-ng starts, so messages will do the entire log from boot in order with all the May 5 dates converted into the time syslog-ng starts and continuing on from there.

 

[orvol]

Hi, I'm a non tech person and just installed this to log and troubleshoot dual wan failover events, before installing this I installed entware on a usb stick, does the log defaulted to the usb stick?

 

[elorimer]

I installed entware on a usb stick, does the log defaulted to the usb stick?

Yes, the default for the log is /opt/var/log/messages. If you create your own destinations you can put them elsewhere (anywhere in the world!).

 

[cmkelley]

UPDATE: This is a much harder problem than it seems. I'm having issues with the logic, I've not forgotten about this problem.

 

[elorimer]

I'm still not understanding what the problem is. Does it matter if syslogd writes to /jffs or /tmp? We kill syslogd.

 

[cmkelley]

I'm still not understanding what the problem is. Does it matter if syslogd writes to /jffs or /tmp? We kill syslogd.

It matters at least because the webgui without uiscribe is looking in the wrong place, /jffs/syslog.log which currently I change to a directory when syslog-ng is running to prevent something, though lol, I've forgotten exactly what. I think there was some process copying syslog.log & syslog.log-1 to /jffs periodically and that was causing an issue. Maybe. It's been a LONG time, and I haven't really thought about scribe for well over 3 years.

There may be other issues, but without one of the affected routers, I really can't speak to them. I also want to be careful in case ASUS changes the flag on other routers as time goes on, I need to be able to handle that.

 

[jsbeddow]

Having gotten rather used to using scribe/uiscribe under my trusty RT-AC86U for the last few years, now that I recently upgraded to a GT-AX6000, I reinstalled that combination after formatting my USB attached SSD and reinstalling Diversion and Skynet. Well, while all is technically "functional", I did notice massive slowdowns (on the order of 30+ seconds) when looking at Diversion or Skynet settings/menus even using direct SSH connections. I have read both this thread and the Scribe 2.5 thread (and a few others that discuss the recent differences in PATH setups that have occurred), but frankly find it all a bit "above my pay grade" in knowing what needs to be done to resolve this kind of issue.

Can we expect any resolution to this sort of glitch coming soon? I do fully appreciate that these scripts are only possible through the dedication of unpaid, volunteer members of this fine SNB community, so this is far from being a demand, just a humble question on my part. Many thanks for all the hard work that has been poured into this over the years.

 

[cmkelley]

Having gotten rather used to using scribe/uiscribe under my trusty RT-AC86U for the last few years, now that I recently upgraded to a GT-AX6000, I reinstalled that combination after formatting my USB attached SSD and reinstalling Diversion and Skynet. Well, while all is technically "functional", I did notice massive slowdowns (on the order of 30+ seconds) when looking at Diversion or Skynet settings/menus even using direct SSH connections. I have read both this thread and the Scribe 2.5 thread (and a few others that discuss the recent differences in PATH setups that have occurred), but frankly find it all a bit "above my pay grade" in knowing what needs to be done to resolve this kind of issue.

Can we expect any resolution to this sort of glitch coming soon? I do fully appreciate that these scripts are only possible through the dedication of unpaid, volunteer members of this fine SNB community, so this is far from being a demand, just a humble question on my part. Many thanks for all the hard work that has been poured into this over the years.

Maybe (resolution of slowness). I think it's related to a recent change in where some models put the syslog.log file by default. I'm currently debugging a fix that's kinda grown out of control, because it gave me the opportunity to learn some awk, which I've been wanting to do. Also, to solve the problem without causing other problems when something isn't just the way I expect it is a bit more of a challenge than I expected.

 

[jsbeddow]

Maybe (resolution of slowness). I think it's related to a recent change in where some models put the syslog.log file by default. I'm currently debugging a fix that's kinda grown out of control, because it gave me the opportunity to learn some awk, which I've been wanting to do. Also, to solve the problem without causing other problems when something isn't just the way I expect it is a bit more of a challenge than I expected.

Thanks, but in my case, the fix turned out to be the one discussed here:

Scribe - error='libssl.so.1.1: wrong ELF class: ELFCLASS32'

Has anyone noticed a drop in nvram usage after the Entware update? it could be placebo,

www.snbforums.com

 

[cmkelley]

@visortgw and @JGrana (and anyone else who wants to be a guinea pig ...

The gamma version of scribe has been updated. I *think* this should work on routers where syslogd wants to write to /jffs, but I can't test that part.

If you want to try the gamma version, follow the instructions here: https://www.snbforums.com/threads/scribe-2-5-0-testers-needed.84478/

Trying to remember my logic from years ago makes my brain hurt.