Scribe scribe - syslog-ng and logrotate installer

[elorimer]

I mostly use Notepad++ or WinSCP, so I didn't know vi had that feature. With syslog-ng holding a file open and skynet writing so frequently, my fat fingers are likely not capable.

 

[juched]

To be honest, I never looked at syslog-ng memory usage. I always had 96-ish% memory used, and I think ~110 megs of swap used, so I never really looked at it. I'll have a look at my AC86U and my AC3200 when I get home tonight (if I remember ...)

I have been noticing my memory on my 88u slowly climbing, about 1-2% every 12 hours. Just checked and syslog.ng is at 300M. Largest by far on the system.

Will compare to later.

 

[JohnDeere]

Hi all,
I cannot install scribe, because i get the error: error while loading shared libraries, cannot open shared object file, no such file or library. syslog-ng version 3.19 or higher required.

I rebooted my AC68U, I updated amtm, but it did not find any update, so my system is up to date. FW 384.15

I removed scribe, then re-added, but I still get this error. Any suggestions, please?

 

[elorimer]

The line in your second screen shot that says "Segmentation fault" looks grim. That might be an entirely separate error to track down.

I think the error message about 3.19 being required is generated because syslog-ng is faulting out. I suspect that might be a sign the entware installation is faulty. I would be inclined to use diversion to save your files (if you can), save your scripts, and copy all of it somewhere else, and then blow up your USB drive: reformat it and start over. With amtm it doesn't really take long.

But maybe you will get a more informed response.

 

[skeal]

Hey people. Not sure why but Skynet stopped logging dropped packets. Everything else seems to work fine. I rebooted and no correction as well as restarting scribe. Any ideas to try? I made no changes, just rebooted is all.

 

[Butterfly Bones]

Hey people. Not sure why but Skynet stopped logging dropped packets. Everything else seems to work fine. I rebooted and no correction as well as restarting scribe. Any ideas to try? I made no changes, just rebooted is all.

I've seen that on occasion. Two things to check.
1 - go into Skynet setting <11>, syslog location <10> then the syslog <1> should be

/opt/var/log/skynet-0.log

2 - Then restart scribe <rs> and that get it going again. Good luck

 

[cmkelley]

Hi all,
I cannot install scribe, because i get the error: error while loading shared libraries, cannot open shared object file, no such file or library. syslog-ng version 3.19 or higher required.
View attachment 21804

I rebooted my AC68U, I updated amtm, but it did not find any update, so my system is up to date. FW 384.15

View attachment 21805

View attachment 21806

I removed scribe, then re-added, but I still get this error. Any suggestions, please?

In the past, this has always been resolved by updating Entware. Yours appears to be updated, but you're also getting a segfault during that check, so you may be getting an erroneous result. from the command line, try:

opkg update
opkg list-upgradable

I suspect you'll get a segfault with one of those. If not, I think you'll find that Entware is actually not up to date. If you do get a segfault, then you have some other issue that I don't know how to fix, sorry.

 

[JohnDeere]

The line in your second screen shot that says "Segmentation fault" looks grim. That might be an entirely separate error to track down.

I think the error message about 3.19 being required is generated because syslog-ng is faulting out. I suspect that might be a sign the entware installation is faulty. I would be inclined to use diversion to save your files (if you can), save your scripts, and copy all of it somewhere else, and then blow up your USB drive: reformat it and start over. With amtm it doesn't really take long.

But maybe you will get a more informed response.

Thank you for your reaction. I tried to check USB drive for errors, but it seemed OK. I have 2 file systems on the USB. EXT2 and windows FAT format (I don't know exactly if it is FAT32 or NTFS, but one of them). The drive is 256GB, but I think this shouldn't be a problem. I have to be careful with reformatting, because I use SMB file server on tis drive with many folders and different access rights, but I will try it.

 

[JohnDeere]

In the past, this has always been resolved by updating Entware. Yours appears to be updated, but you're also getting a segfault during that check, so you may be getting an erroneous result. from the command line, try:

opkg update
opkg list-upgradable

I suspect you'll get a segfault with one of those. If not, I think you'll find that Entware is actually not up to date. If you do get a segfault, then you have some other issue that I don't know how to fix, sorry.

Thank you for your reply. I tried to force update amtm, but after force update, scribe still did not install. I think my syslog-ng should not be too old, because I am using amtm and skynet for about 2 weeks only.
However, I am constantly having a problem with my router for almost a year now, even after reset: web history and traffic analizer still empty. But that is another issue. I will try reinstalling amtm from scratch to see if that helps updating syslog-ng...

 

[cmkelley]

Thank you for your reaction. I tried to check USB drive for errors, but it seemed OK. I have 2 file systems on the USB. EXT2 and windows FAT format (I don't know exactly if it is FAT32 or NTFS, but one of them). The drive is 256GB, but I think this shouldn't be a problem. I have to be careful with reformatting, because I use SMB file server on tis drive with many folders and different access rights, but I will try it.

Segmentation fault is a memory / operating system error, not an error on a filesystem. Your USB drive is fine, you have something going on with a program trying to access memory that does not belong to it.

 

[JohnDeere]

Segmentation fault is a memory / operating system error, not an error on a filesystem. Your USB drive is fine, you have something going on with a program trying to access memory that does not belong to it.

Do you mean it could also indicate an error within the router firmware, or in this case it only refers to the installed entware packages?

 

[cmkelley]

Do you mean it could also indicate an error within the router firmware, or in this case it only refers to the installed entware packages?

A bit out of my league, but probably an Entware package. Could be hardware problem as well I think. Almost certainly not a firmware "problem" or else countless others would have the same.

 

[JohnDeere]

A bit out of my league, but probably an Entware package. Could be hardware problem as well I think. Almost certainly not a firmware "problem" or else countless others would have the same.

I finally succeeded, however I still don't know the reason of the segmentation fault
What I did is in amtm I chose ep (manage packages), then update and upgrade packages (1) , which then downloaded something again, and when I checked for updates after that, there was no segmentation fault error anymore... And also found an update for skynet. Then I could install scribe and uiscribe too without a problem.

Now my logserver logging is not working anymore. I am using papertrail for external logging, but I don't know where to set it up again in this new UI. Is there a way to set up a logserver address at all?

Also please take a look on the screenshot below. I have a null line... Is that normal?

Thank you for the tips and help

 

[JohnDeere]

The line in your second screen shot that says "Segmentation fault" looks grim. That might be an entirely separate error to track down.

I think the error message about 3.19 being required is generated because syslog-ng is faulting out. I suspect that might be a sign the entware installation is faulty. I would be inclined to use diversion to save your files (if you can), save your scripts, and copy all of it somewhere else, and then blow up your USB drive: reformat it and start over. With amtm it doesn't really take long.

But maybe you will get a more informed response.

Segmentation fault was the key to solution - thanks for pointing this out!

 

[elorimer]

Now my logserver logging is not working anymore. I am using papertrail for external logging, but I don't know where to set it up again in this new UI. Is there a way to set up a logserver address at all?

Also please take a look on the screenshot below. I have a null line... Is that normal?

Use uiScribe to exclude it. Uiscribe scrubs the log directory or the syslog-ng.d directory, I forget, and displays what it finds unless it is excluded.

I'm not familiar with papertrail, but to send log messages to an external destination, you need to define that destination, and a filter if you want, and then a logging statement. Scribe operates as a waterfall, filtering messages in order and removing them from further processing. The order is by line within a file, and by file in syslog-ng.d by alphabet. So if you want a message to be in both places, you need a file that comes first in syslog-ng.d, without the "flags(final)" statement. It's laid out somewhere in this thread.

 

[Butterfly Bones]

I finally succeeded, however I still don't know the reason of the segmentation fault
What I did is in amtm I chose ep (manage packages), then update and upgrade packages (1) , which then downloaded something again, and when I checked for updates after that, there was no segmentation fault error anymore... And also found an update for skynet. Then I could install scribe and uiscribe too without a problem.

Now my logserver logging is not working anymore. I am using papertrail for external logging, but I don't know where to set it up again in this new UI. Is there a way to set up a logserver address at all?

Also please take a look on the screenshot below. I have a null line... Is that normal?
View attachment 21830

Thank you for the tips and help

If papertrail needs just the IP address and port, temporarily uninstall uiScribe and you will see those in the standard WebGUI - uiScribe replaces that.

 

[JohnDeere]

Use uiScribe to exclude it. Uiscribe scrubs the log directory or the syslog-ng.d directory, I forget, and displays what it finds unless it is excluded.

I'm not familiar with papertrail, but to send log messages to an external destination, you need to define that destination, and a filter if you want, and then a logging statement. Scribe operates as a waterfall, filtering messages in order and removing them from further processing. The order is by line within a file, and by file in syslog-ng.d by alphabet. So if you want a message to be in both places, you need a file that comes first in syslog-ng.d, without the "flags(final)" statement. It's laid out somewhere in this thread.

OK your're right. I forgot to check what options are there for uiscribe. I excluded the null log. Thanks!

 

[JohnDeere]

If papertrail needs just the IP address and port, temporarily uninstall uiScribe and you will see those in the standard WebGUI - uiScribe replaces that.

Thank you! I have the IP and port, and it used to work until I installed scribe. Does this mean that external syslog server will not receive logs anymore with scribe installed..?

 

[Butterfly Bones]

Thank you! I have the IP and port, and it used to work until I installed scribe. Does this mean that external syslog server will not receive logs anymore with scribe installed..?

That is a question primarily for @Jack Yaz to answer. I mentioned him in another thread if the underlying System Log functions were still operative, just web page overly changes. There was no reply, let's see if this gets his attention.

 

[JohnDeere]

That is a question primarily for @Jack Yaz to answer. I mentioned him in another thread if the underlying System Log functions were still operative, just web page overly changes. There was no reply, let's see if this gets his attention.

Yes, that is an interesting question. For me it seems that there is some conflict. The log below shows the time when I installed scribe and uiscribe at 12:18 klogd exiting...

Mar 09 12:18:28 RT-AC68U_WHITE kernel klogd: exiting
Mar 09 15:21:38 RT-AC68U_WHITE kernel klogd started: BusyBox v1.25.1 (2020-02-08 13:38:20 EST)
Mar 09 15:21:39 RT-AC68U_WHITE kernel klogd: exiting
Mar 09 15:21:39 RT-AC68U_WHITE rc_service httpds 255:notify_rc restart_logger
Mar 09 15:21:39 RT-AC68U_WHITE custom_script Running /jffs/scripts/service-event (args: restart logger)
Mar 09 15:21:40 RT-AC68U_WHITE kernel klogd started: BusyBox v1.25.1 (2020-02-08 13:38:20 EST)
Mar 09 15:21:43 RT-AC68U_WHITE kernel klogd: exiting
Mar 09 15:33:38 RT-AC68U_WHITE kernel klogd started: BusyBox v1.25.1 (2020-02-08 13:38:20 EST)
Mar 09 15:33:39 RT-AC68U_WHITE kernel klogd: exiting

Then I uninstalled uiscribe, and I got back to the built-in UI with syslog server address. I clicked on APPLY at 15:21 klogd started...
As you can see, it stops after a few seconds. The link to the syslog server (papertrail) works, these logs are copied from its UI.
Each time I APPLY, it starts and exits.

Scribe installed, uiscribe uninstalled.