Menu
What's new
By:
Filters Better Search

Scribe scribe - syslog-ng and logrotate installer

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

elorimer said:
You might try stopping scribe and loading syslog-ng in the foreground, which I think is
Code: 
syslog-ng -Fevd
If memory serves you can then see exactly the line that triggers the error.

EDIT: So I see this error, and another, on my AC56 with 3.23, and not on my 87 with 3.20. Starting in the foreground with -Fevd starts without throwing the error.

EDIT2: But now the error is gone on my 56. ??
Click to expand...

when i run

Code: 
syslog-ng -Fevd

I get
Code: 
[2019-11-06T23:49:42.061667] Module loaded and initialized successfully; module'
[2019-11-06T23:49:42.062835] Follow-mode file source not found, deferring open;'
[2019-11-06T23:49:42.065444] Running application hooks; hook='1'
[2019-11-06T23:49:42.065502] Running application hooks; hook='6'
[2019-11-06T23:49:42.065736] syslog-ng starting up; version='3.23.1'
[2019-11-06T23:49:42.065801] Running application hooks; hook='2'
[2019-11-06T23:49:43.060533] Follow mode file still does not exist; filename='/'
[2019-11-06T23:49:44.070437] Follow mode file still does not exist; filename='/'
[2019-11-06T23:49:45.070463] Follow mode file still does not exist; filename='/'
[2019-11-06T23:49:46.080469] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:47.090478] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:48.100424] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:49.100472] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:50.110431] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:51.110436] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:52.120466] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:53.130431] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:54.130459] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:55.140438] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:56.140477] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:57.150433] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:58.150436] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:59.150478] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:00.150499] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:01.160481] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:02.170526] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:03.180480] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:04.180546] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:05.190483] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:06.200475] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:07.200526] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:08.210472] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:09.210491] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:10.210537] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:11.220476] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:12.230465] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:13.230467] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:14.230537] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:15.230525] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:16.240543] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:17.250535] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:18.260522] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:19.270551] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:20.280477] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:21.280508] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:22.290516] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
 
SomeWhereOverTheRainBow said:
when i run

Code: 
syslog-ng -Fevd

I get
Code: 
[2019-11-06T23:49:42.061667] Module loaded and initialized successfully; module'
[2019-11-06T23:49:42.062835] Follow-mode file source not found, deferring open;'
[2019-11-06T23:49:42.065444] Running application hooks; hook='1'
[2019-11-06T23:49:42.065502] Running application hooks; hook='6'
[2019-11-06T23:49:42.065736] syslog-ng starting up; version='3.23.1'
[2019-11-06T23:49:42.065801] Running application hooks; hook='2'
[2019-11-06T23:49:43.060533] Follow mode file still does not exist; filename='/'
[2019-11-06T23:49:44.070437] Follow mode file still does not exist; filename='/'
[2019-11-06T23:49:45.070463] Follow mode file still does not exist; filename='/'
[2019-11-06T23:49:46.080469] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:47.090478] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:48.100424] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:49.100472] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:50.110431] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:51.110436] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:52.120466] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:53.130431] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:54.130459] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:55.140438] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:56.140477] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:57.150433] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:58.150436] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:49:59.150478] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:00.150499] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:01.160481] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:02.170526] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:03.180480] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:04.180546] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:05.190483] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:06.200475] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:07.200526] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:08.210472] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:09.210491] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:10.210537] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:11.220476] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:12.230465] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:13.230467] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:14.230537] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:15.230525] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:16.240543] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:17.250535] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:18.260522] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:19.270551] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:20.280477] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:21.280508] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
[2019-11-06T23:50:22.290516] Follow mode file still does not exist; filename='/var/lib/logrotate.status'
Click to expand...
See this -
https://www.snbforums.com/threads/scribe-syslog-ng-and-logrotate-installer.55853/page-17#post-481910

In AMTM use 5 to open scribe.
Run "lr" to run logrotate once should fix it.
 
cmkelley said:
I thought I added a logrotate run after install ... I was just looking at the code over the weekend and I'm pretty sure I saw it.
Click to expand...
That link is you stating exactly that you would add, "run logrotate once at startup on fresh install". I remember this issue and I just suggested running "lr" would resolve the issue, whatever it may be.
 
Butterfly Bones said:
That link is you stating exactly that you would add, "run logrotate once at startup on fresh install". I remember this issue and I just suggested running "lr" would resolve the issue, whatever it may be.
Click to expand...
Yeah, I went to the link, that's what prompted my comment. I had forgotten all about that issue and I was curious what was at your link. :)

And yes, now that I'm home, the current version (2.1.3) does run logrotate once on installation.
 
cmkelley said:
Yeah, I went to the link, that's what prompted my comment. I had forgotten all about that issue and I was curious what was at your link. :)

And yes, now that I'm home, the current version (2.1.3) does run logrotate once on installation.
Click to expand...
Code: 
 scribe installed version: v2.1_2 (master)
             scribe GitHub version: v2.1_2 (master)
                    scribe is up to date!
Typo or are you stealing time to code? :)
 
Last edited:
Butterfly Bones said:
Code: 
 scribe installed version: v2.1_2 (master)
             scribe GitHub version: v2.1_2 (master)
                    scribe is up to date!
Typo or are you stealing time to code? :)
Click to expand...
Coding. Starting to test on my AC3200 (and already found a bug!), hope to push a new version tomorrow evening (Thursday, PST) or Friday evening.
 
in skynet what should the log path be set for to function normally?
currently i see entries in the log because mnt/sda1/skynet/skynet.log is configured in the syslog 1 custom section. There is no data in this file so if I get the stat report in skynet no ip address, the log will still be collected in the syslog-ng folder in the skynet-0.log file along with the rest.
if i do not modify the log path in skynet skynet will overwrite tmp/syslog.log symlink with normal file type and all logging will stop.
what is the solution to make it work normally?
 
Skynet should be pointed to the destination file defined for skynet logging in the configuration file in /opt/etc/syslog-ng.d. The scribe example is /opt/etc/syslog-ng.d/skynet and contains
Code: 
destination d_skynet { 
    file("/opt/var/log/skynet-0.log", time-reap(2));
};
so you would point skynet to /opt/var/log/skynet-0.log
 
elorimer said:
Skynet should be pointed to the destination file defined for skynet logging in the configuration file in /opt/etc/syslog-ng.d. The scribe example is /opt/etc/syslog-ng.d/skynet and contains
Code: 
destination d_skynet {
    file("/opt/var/log/skynet-0.log", time-reap(2));
};
so you would point skynet to /opt/var/log/skynet-0.log
Click to expand...
Thank You answer! I try!
 
glehel said:
in skynet what should the log path be set for to function normally?
currently i see entries in the log because mnt/sda1/skynet/skynet.log is configured in the syslog 1 custom section. There is no data in this file so if I get the stat report in skynet no ip address, the log will still be collected in the syslog-ng folder in the skynet-0.log file along with the rest.
if i do not modify the log path in skynet skynet will overwrite tmp/syslog.log symlink with normal file type and all logging will stop.
what is the solution to make it work normally?
Click to expand...
FYI, scribe should have correctly set the syslog 1 custom section on installation. But it won't fix it if it gets changed afterwords.
 
SomeWhereOverTheRainBow said:
what does this mean

Code: 
Please select an option: rl
 reloading syslog-ng.conf ... EOF occurred while reading control socket

 Restarting uiScribe ...            done.
Click to expand...
joe68000 said:
I am seeing this as well on an RT-AC5300
Click to expand...
Okay, sorry for the long delay in response, I finally got scribe up on my AC3200 (testing router) and I get it there (but not on my 86U main router) ... so right now my best guess is an error in the armv71 syslog-ng package in Entware. It started happening with 3.23, I had not seen it with 3.20 on my AC3200.
 
I managed to solve my problem with a hard link. in skynet it doesn't matter what log path I specify except for opt/var/ log/skynet-0.log and tmp/syslog.log. The problem I had was that skynet couldn't generate statistics because it was generated from /skynet/skynet.log. If I set the opt/var/log/skynet-0.log path in skynet's custom option, logging stopped within an hour and emptied the file. skynet-0.log This file should not be written to another program because it stops logging. I made a hard link to skynet-0.log which points to the skynet /skynet.log file which is also RW. in skynet the log file setting this is set to "syslogloc ="/mnt/sda1/skynet/skynet-0.log "but there is no such file in the folder, I could write it here syslog.log would work as well.
it works fine for me.
 
glehel said:
I managed to solve my problem with a hard link. in skynet it doesn't matter what log path I specify except for opt/var/ log/skynet-0.log and tmp/syslog.log. The problem I had was that skynet couldn't generate statistics because it was generated from /skynet/skynet.log. If I set the opt/var/log/skynet-0.log path in skynet's custom option, logging stopped within an hour and emptied the file. skynet-0.log This file should not be written to another program because it stops logging. I made a hard link to skynet-0.log which points to the skynet /skynet.log file which is also RW. in skynet the log file setting this is set to "syslogloc ="/mnt/sda1/skynet/skynet-0.log "but there is no such file in the folder, I could write it here syslog.log would work as well.
it works fine for me.
Click to expand...
Did you make the necessary changed to the skynet filter file in /opt/entware/etc/syslog-ng.d directory?
See the new one in this postt.
https://www.snbforums.com/threads/scribe-syslog-ng-and-logrotate-installer.55853/page-44#post-524344

Copied here for clarity:
Code: 
# this MUST BE the file configured in Skynet as the syslog.log location
# DO NOT use /tmp/syslog.log or /opt/var/log/messages here!
destination d_skynet {
   file("/opt/var/log/skynet-0.log", time-reap(2));
};

# logs everything from Skynet to /opt/var/log/skynet-0.log
filter f_skynet {
   program("Skynet") or
   message("BLOCKED -") or
   message("DROP IN=");
};

# final flag stops processing of messages matching the f_skynet filter
log {
   source(src);
   filter(f_skynet);
   destination(d_skynet);
   flags(final);
};

#eof
 
I didn't modify this file if I set it up in skynet and it didn't work properly. now it works really well :)
 
glehel said:
I managed to solve my problem with a hard link.
Click to expand...
I guess it's good that it works well for you. All I can say is, if I understand what you've done (and I don't think I do), you are doing something that isn't contemplated by skynet, scribe or syslog-ng. If anyone else runs in to the 3.23 problem, they should not do whatever it is you've done. No need to touch anything in the {device}/skynet directory.
 
these two files are the same, so the log works in the GUI. and skynet stats well (13 points).
 

Attachments

  • log.jpg
    log.jpg
    120 KB · Views: 223
  • skynet.jpg
    skynet.jpg
    33 KB · Views: 195
glehel said:
I managed to solve my problem with a hard link. in skynet it doesn't matter what log path I specify except for opt/var/ log/skynet-0.log and tmp/syslog.log. The problem I had was that skynet couldn't generate statistics because it was generated from /skynet/skynet.log. If I set the opt/var/log/skynet-0.log path in skynet's custom option, logging stopped within an hour and emptied the file. skynet-0.log This file should not be written to another program because it stops logging. I made a hard link to skynet-0.log which points to the skynet /skynet.log file which is also RW. in skynet the log file setting this is set to "syslogloc ="/mnt/sda1/skynet/skynet-0.log "but there is no such file in the folder, I could write it here syslog.log would work as well.
it works fine for me.
Click to expand...

Please undo whatever hardlinks you created. Files in /skynet/ are not to be manually modified and contain multiple sets of information.

Instead follow the instructions provided on how to properly setup this script.
 
scribe v2.2_0 is out.

Please update everything, including filter files, some defaults have had to change. It's likely (but not confirmed) you need to be using syslog-ng 3.23 if you use skynet for the new filter to work.

After updating, you need to:
Code: 
cp /opt/share/syslog-ng/examples/blankmsg /opt/etc/syslog-ng.d
cp /opt/share/syslog-ng/examples/wlceventd /opt/etc/syslog-ng.d
And if you are using Skynet (and ONLY if you are using Skynet):
Code: 
cp /opt/share/syslog-ng/examples/skynet /opt/etc/syslog-ng.d
If you are NOT using Skynet, you should:
Code: 
cp /opt/share/logrotate/examples/firewall /opt/etc/logrotate.d
to keep the firewall log size down. If you are using uiScribe, a huge firewall log will cause huge delays on that page in the WEBUI.

NOTE: for certain routers (I think any armv71 router) you will see error messages similar to:
Code: 
reloading syslog-ng.conf ... EOF occurred while reading control socket
As far as I can tell, this is a bug in the armv71 version of syslog-ng in Entware, but more importantly, appears to have no effect on operation of syslog-ng.

I apologize for the huge delay in getting a version out that supports the new syslog-ng issue with skynet. Unfortunately it is down to me not knowing how to make multiple local branches with github.

EDIT: oh, forgot, after copying the files as described above, you'll need to run scribe and reload ('rl') the configuration for the updated files to take effect.
 
Last edited:
If you updated scribe very soon after I posted the previous, and you're getting wlceventd "Auth" messages in your system log, you can just use the 'u' command again, answer 'n' to reinstalling scribe, then 'y' to updating the filter files, then copy the wlceventd file as describe above and reload 'rl' the syslog-ng.conf file.
 
You must log in or register to reply here.

Similar threads

Tarek Yag
Scribe [SOLVED] syslog-ng intermittent failure to shutdown which messes all logging
Replies
15
Views
682
Tarek Yag
Tarek Yag
SomeWhereOverTheRainBow
Scribe Issues with scribe.... Errors all over the place after restarting scribe!
Replies
8
Views
2K
SomeWhereOverTheRainBow
SomeWhereOverTheRainBow
S
Scribe Strange Issue with Scribe / Syslog-NG after Reboot
Replies
7
Views
1K
Ripshod
Ripshod
cmkelley
Scribe scribe 3.x_y - syslog-ng and logrotate installer
10 11 12
Replies
234
Views
21K
matthew_eli
matthew_eli
Davidncali001
Skynet Message on SKYNET I havent seen before
Replies
1
Views
333
Davidncali001
Davidncali001
Similar threads
Thread starter Title Forum Replies Date
S Scribe Strange Issue with Scribe / Syslog-NG after Reboot Asuswrt-Merlin AddOns 7
V Scribe Scribe nvram log_path - what should it be? Asuswrt-Merlin AddOns 4
SomeWhereOverTheRainBow Scribe Issues with scribe.... Errors all over the place after restarting scribe! Asuswrt-Merlin AddOns 8
Tarek Yag Scribe [SOLVED] syslog-ng intermittent failure to shutdown which messes all logging Asuswrt-Merlin AddOns 15
J AdGuardHome There are tons of dnsproxy error messages occuring on syslog. Asuswrt-Merlin AddOns 2
T Updated scMerlin to 2.5.5 - syslog stops at 'syslogd exiting' Asuswrt-Merlin AddOns 9

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 871 (members: 23, guests: 848)
Top