Scribe scribe - syslog-ng and logrotate installer

[joe scian]

OK I did a brand new install of Scribe. The messages log in WEBGUI are there now and both /tmp/syslog.log and /tmp/syslog.log-1 are there. As soon as I run logrotate now from menu - /tmp/syslog.log and /tmp/syslog.log-1 dissapear and no messages appear in WEBGUI. I then run

ln -s /opt/var/log/messages /tmp/syslog.log

and I have /tmp/syslog.log but no /tmp/syslog.log-1 because symbolic link is missing? I have WEBGUI messages again - yah !!!! So there is an issue with Log rotate from menu and Log Rotate in general?

The symbolic link is persistent because I then transferred some filter examples from examples directory to appropriate directories. I then did a further log rotate from menu and /tmp/syslog.log is still there and WEBGUI messages there.

 

[Butterfly Bones]

Such a puzzle! No /tmp/syslog.log in the directory at all. If you make the symlink in a terminal what happens:

ln -s /opt/var/log/messages /tmp/syslog.log

I had the same thing happen a few times in the very early testing. like @akb and @joe scian have now.
https://www.snbforums.com/threads/s...-logrotate-installer.55853/page-5#post-478293

I do not remember what got it back except uninstall scribe, reboot router, install scribe. I know I did Ctrl-F5 a few times and tried to clear ASUS cookies in Chrome. I just searched back my old posts thinking it might jog my memory about resolving, but no idea now, sorry.

 

[elorimer]

Don't worry about syslog.log-1. With syslog-ng running it never comes into play, and no symlink for that is necessary. Not sure why @cmkelley added putting a stub statement in there, but I'm sure he had reasons.

Logrotate interrupts syslog-ng and requires a -HUP command restarting it. Logrotate, in my mind, is only a convenience for the log files to be kept to a convenient size, and ultimately discarded It is never necessary or appropriate to run logrotate manually. <--watch me be wrong.

On the other hand, if you are adding filters, then you need to do "scribe restart" to get them read in. But not through logrotate.

It isn't exactly that the symlink is persistent. But scribe seems to have captured those instances when the symlink is destroyed, and recreates it on the fly.

 

[Jumpstarter]

ooooocrap I installed this and now my syslogs is empty! did I do something wrong? all i see is...

### Top of Log File ###

 

[Butterfly Bones]

ooooocrap I installed this and now my syslogs is empty! did I do something wrong? all i see is...

### Top of Log File ###

Two others reported the same issue back up this page. I had the error in early testing. Still no apparent reason why. Best suggestion I have is uninstall scribe, reboot the router, let it settle at least 10 minutes. Install scribe again. What other script add on are you using?

 

[joe scian]

ooooocrap I installed this and now my syslogs is empty! did I do something wrong? all i see is...

### Top of Log File ###

try this
ln -s /opt/var/log/messages /tmp/syslog.log

 

[cmkelley]

ooooocrap I installed this and now my syslogs is empty! did I do something wrong? all i see is...

### Top of Log File ###

Odd, that's what I put in /tmp/syslog.log-1, so that was created correctly but it either didn't create the symlink from /tmp/syslog.log to /opt/var/log/messages or it didn't copy syslog-log to messages. Is there a file /opt/var/log/messages? If there is, is it empty or does it contain your log entries?

 

[Jumpstarter]

okay so I uninstalled and syslogs came back. and I reinstalled- rebooted, now everything appears to be working. thanks for the help guys .

 

[joe scian]

Odd, that's what I put in /tmp/syslog.log-1, so that was created correctly but it either didn't create the symlink from /tmp/syslog.log to /opt/tmp/messages/ or it didn't copy syslog-log to messages. Is there a file /opt/tmp/log/messages? If there is, is it empty or does it contain your log entries?

shouldnt that be /opt/var/log/messages - btw that was fine in my setup when i didnt have /tmp/syslog.log

Interesting fact - I edited a line out of my firewall-start script and i restarted firewall-start. I immediately lost /tmp/syslog.log and of course my WEBGUI log. the line was just outputting messagges when trying to debug Jack Yaz script.

I recreated the symbolic link from /opt/var/log/messages - and /tmp/syslog.log is now there and so are WEBGUI messages.

The firewall-start script is below and the commented out line is shown

#!/bin/sh

sh /jffs/scripts/firewall start skynetloc=/tmp/mnt/MY_LINUX/skynet # Skynet Firewall Addition
/jffs/scripts/YazFi runnow & # YazFi Guest Networks

#iptables -I YazFiREJECT -j LOG --log-prefix "REJECT " --log-tcp-sequence --log-tcp-options --log-ip-options   
 
 iptables -I YazFiINPUT -i wl0.1 -m multiport -p udp --dports 137,138 -j ACCEPT
 iptables -I YazFiINPUT -i wl0.1 -p udp --dport 5353 -j ACCEPT
 iptables -I YazFiINPUT -i wl0.1 -p tcp --dport 8200 -j ACCEPT

/jffs/scripts/FreshJR_QOS -start $1 &

 

[cmkelley]

OK I did a brand new install of Scribe. The messages log in WEBGUI are there now and both /tmp/syslog.log and /tmp/syslog.log-1 are there. As soon as I run logrotate now from menu - /tmp/syslog.log and /tmp/syslog.log-1 dissapear and no messages appear in WEBGUI. I then run

ln -s /opt/var/log/messages /tmp/syslog.log

and I have /tmp/syslog.log but no /tmp/syslog.log-1 because symbolic link is missing? I have WEBGUI messages again - yah !!!! So there is an issue with Log rotate from menu and Log Rotate in general?

The symbolic link is persistent because I then transferred some filter examples from examples directory to appropriate directories. I then did a further log rotate from menu and /tmp/syslog.log is still there and WEBGUI messages there.

That's weird, but perhaps a clue. logrotate gets run once when scribe is installed, and running logrotate from the menu calls the exact same code in the script, so why it they would disappear when running logrotate from the menu is baffling. Maybe some people not getting the symlink on first install is because the logroate run is somehow wiping out those two files, which it shouldn't even be touching in the first place.

 

[cmkelley]

shouldnt that be /opt/var/log/messages - btw that was fine in my setup when i didnt have /tmp/syslog.log

Thanks, fixed. It's been a long day.

 

[cmkelley]

okay so I uninstalled and syslogs came back. and I reinstalled- rebooted, now everything appears to be working. thanks for the help guys .

What router and firmware are you using?

 

[Jumpstarter]

i am using a rtax88u. i think the issue was caused by an old version of diversion and skynet, which i just updated today right before installing, but idk- maybe i should have rebooted before installing.

 

[cmkelley]

Don't worry about syslog.log-1. With syslog-ng running it never comes into play, and no symlink for that is necessary. Not sure why @cmkelley added putting a stub statement in there, but I'm sure he had reasons.

My CDO demanded it. CDO is like OCD, except the letters are arranged alphabetically LIKE THEY BELONG! ;-) Some thought about knowing if I was actually at the top of the log if looking at it in the webgui.

 

[Jumpstarter]

has anyone reported this effecting the network map?

 

[joe scian]

Hi cmkelley
i updated my post 629 above - maybe further clues as to whats happening?

 

[kernol]

Warning - non-coder question ... [i.e. - showing my ignorance]

Is it possible to provide a "Temporarily disable Scribe" in the Scribe v2 menu system [much like the one in Skynet]???
I assume that would require re-invoking of the firmware provided syslog programs with all messages returning to the Webgui System Log page?
That would be followed, when done, with "Restart Syslog-ng" [already in the menu].

Why do I ask? - because, aside from testing issues, that same routine would be usefully auto-invoked when the USB is ejected. Right now when the USB is ejected ... "### Top of Log File ###" gets written to System Log [Webgui] and nothing appears after it - no matter how long you wait.

 

[cmkelley]

Hi cmkelley
i updated my post 629 above - maybe further clues as to whats happening?

Hrm. If you can re-create when you lose the syslog.log symlink, immediately after you lose, it, type

ps | grep log

if you see "syslogd" or "klogd" something is restarting those that I need to figure out how to detect so I can kill them.

 

[cmkelley]

Warning - non-coder question ... [i.e. - showing my ignorance]

Is it possible to provide a "Temporarily disable Scribe" in the Scribe v2 menu system [much like the one in Skynet]???
I assume that would require re-invoking of the firmware provided syslog programs with all messages returning to the Webgui System Log page?
That would be followed, when done, with "Restart Syslog-ng" [already in the menu].

Why do I ask? - because, aside from testing issues, that same routine would be usefully auto-invoked when the USB is ejected. Right now when the USB is ejected ... "### Top of Log File ###" gets written to System Log [Webgui] and nothing appears after it - no matter how long you wait.

Good idea. Hopefully can implement no later than this coming weekend, my weeknights are looking iffy for the rest of the week.

 

[joe scian]

cmkelly

OK - I restarted QOS by going to QOS page and hitting apply which calls firewall-start and nat-start and I lost /tmp/syslog.log. After doing a ps | grep log this is what i got

joescian@RT-AC5300:/jffs/scripts# ps | grep log
 3107 nobody   42320 D    dnsmasq --log-async
 3108 joescian  1332 S    dnsmasq --log-async
 8383 joescian  8452 S    {syslog-ng} supervising syslog-ng
 8384 joescian 15324 S    syslog-ng
joescian@RT-AC5300:/jffs/scripts# ps | grep log
 3107 nobody   42320 S    dnsmasq --log-async
 3108 joescian  1332 S    dnsmasq --log-async
 7898 joescian  4492 S    grep log
 8383 joescian  8452 S    {syslog-ng} supervising syslog-ng
 8384 joescian 15324 S    syslog-ng