Solved strange behaviour of hostname in syslog logging

[lightaffaire]

Running merlin 386.4 on an AX11000 with remote syslog to our central syslog server.

The logged entries arrive but with an hostname "firewall-E2979BA-C" that does not match the LAN hostname I setup. ie,

Feb 19 11:44:24 firewall-E2979BA-C hostapd: eth7: STA 54:8d:5a:7b:64:20 IEEE 802.11: associated
Feb 19 11:44:24 firewall-E2979BA-C kernel: CFG80211-ERROR) wl_cfg80211_change_station : WLC_SCB_AUTHORIZE sta_flags_mask not set
Feb 19 11:44:24 firewall-E2979BA-C hostapd: eth7: STA 54:8d:5a:7b:64:20 RADIUS: starting accounting session A660597A2FCD2232

In the LAN setup mask i set the hostname to just "firewall".

If I had not explicitly changed the LAN hostname I would understand but I changed it so would expect only "firewall" that to be syslogged.

Can that be fixed in an upcoming merlin release?

Iain

 

[ColinTaylor]

This is intentional behaviour. It's something Asus did. I think it related to the way AiMesh works.

https://github.com/RMerl/asuswrt-merlin.ng/blob/ee5277cb12d7b3c5b82c0c4887d875db6fef22e9/release/src/router/rc/services.c#L4867

 

[lightaffaire]

I can understand the concept of "{hostname}-meshID" being used internally but if I set an explicit hostname and log it remotely I would expect the LAN hostname to be logged.

Also running the command "$ hostname" when logged into the AX11000 via ssh returns the LAN hostname.

remote syslogging should log with the LAN hostname.

 

[RMerlin]

remote syslogging should log with the LAN hostname.

It does according to the quoted code:

snprintf(syslog_hostname, sizeof(syslog_hostname), "%s-%s-%s",
                 get_lan_hostname(), gid, node_str());

However nodes don't have a configurable hostname, so chances are the log comes from one of the nodes, not from the main (named) router.

 

[Maverickcdn]

I noted this behavior when it first appeared here cfg_group appended to hostname

Just use a script in services-start to kill syslogd and restart it with the host name you want.

#!/bin/sh

F_log() { printf '%s' "$1" | logger -t "syslogcheck[$$]" ; printf '%s\n' "$1" ;}

cfg_id=$(nvram get cfg_group | cut -c -7)
lan_name=$(nvram get lan_hostname)
current_syslogd=$(/bin/pidof syslogd)
remote_ip=$(nvram get log_ipaddr)

F_syslog_restart() {
        F_log "Stopping $current_syslogd syslogd service to restart for new hostname"
        /bin/kill "$current_syslogd"
        /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 8 -R ${remote_ip}:514 -L -H $lan_name
        sleep 2
        F_log "syslogd successfully restarted for new hostname - $lan_name"
}

if ps -w | grep "${lan_name}-${cfg_id}" | grep -v 'grep' ; then
        F_log "syslogd using incorrect hostname, restarting..."
        F_syslog_restart
else
        F_log "syslogd using correct hostname, ignoring."
fi

 

[lightaffaire]

I noted this behavior when it first appeared here cfg_group appended to hostname

Just use a script in services-start to kill syslogd and restart it with the host name you want.

#!/bin/sh

F_log() { printf '%s' "$1" | logger -t "syslogcheck[$$]" ; printf '%s\n' "$1" ;}

cfg_id=$(nvram get cfg_group | cut -c -7)
lan_name=$(nvram get lan_hostname)
current_syslogd=$(/bin/pidof syslogd)
remote_ip=$(nvram get log_ipaddr)

F_syslog_restart() {
        F_Log "Stopping $current_syslogd syslogd service to restart for new hostname"
        /bin/kill "$current_syslogd"
        /sbin/syslogd -m 0 -S -O /tmp/syslog.log -s 256 -l 8 -R ${remote_ip}:514 -L -H $lan_name
        sleep 2
        F_log "syslogd successfully restarted for new hostname - $lan_name"
}

if ps | grep "${lan_name}-${cfg_id}" | grep -v 'grep' ; then
        F_log "syslogd using incorrect hostname, restarting..."
        F_syslog_restart
else
        F_log "syslogd using correct hostname, ignoring."
fi

Thanks for the answer and script. That is a hack but a useful one.

You mention services-start... do you mean simply put the script into /tmp/etc/init.d and symlink from /tmp/etc/rc3.d/ ?

Is there a thread or reference document(s) concerning the boot and service/scripts startup sequence ?

Iain

 

[L&LD]

Home · RMerl/asuswrt-merlin.ng Wiki · GitHub

Look at Usage 1. User Scripts

 

[lightaffaire]

@L&LD thank you. so i copied the script to /jffs/scripts and ran it per hand to check it worked. Where exactly are the scripts activated in the GUI as I clicked everywhere on 386.4 and did not see a toggle or referernce to jffs ?

@Maverickcdn the script did the trick but contained a minor buglet:

Old: F_Log "Stopping $current_syslogd syslogd service to restart for new hostname"

Fix: F_log "Stopping $current_syslogd syslogd service to restart for new hostname"

 

[octopus]

@L&LD thank you. so i copied the script to /jffs/scripts and ran it per hand to check it worked. Where exactly are the scripts activated in the GUI as I clicked everywhere on 386.4 and did not see a toggle or referernce to jffs ?

@Maverickcdn the script did the trick but contained a minor buglet:

Old: F_Log "Stopping $current_syslogd syslogd service to restart for new hostname"

Fix: F_log "Stopping $current_syslogd syslogd service to restart for new hostname"

Administration => System => Persistent JFFS2 partition

 

[lightaffaire]

@octopus ahh it just enables the whole scripts dir. I was expecting a yes/no per script. Thank you.

 

[L&LD]

Yes, custom scripts and configs (multiple, all/none).