syslog on jffs

[RMerlin]

Does this mean you won't consider selection via an nvram variable? At one point, it looked like you would (Issue #519).

I might, it's just not a high priority at this point.

 

[ah83]

save jfss

Hello,
thanks for all. I have found this solution : to copy a file of 30 Mb into jffs, then no more space for logfiles (sorry for my poor english).
By

 

[AlterMax]

Hello,
thanks for all. I have found this solution : to copy a file of 30 Mb into jffs, then no more space for logfiles (sorry for my poor english).
By

Sorry, but I think it's really strange decision...
I create an empty folder with the same name (syslog.log) in JFFS, and it blocks the creation of a file. I hope that my solution will help someone

 

[user2k10]

A simple solution that I use is to mount /jffs readonly in the init-start script.

#!/bin/sh

/usr/bin/logger -t $(basename $0) "started [$@]"

# Remount /jffs partition readonly
mount -o remount,ro,noatime /jffs

/usr/bin/logger -t $(basename $0) "finished [$@]"

To install the above, login via PuTTY etc:

1. Add the above script to the /jffs/scripts/init-start file
2. chmod 755 /jffs/scripts/init-start
3. rm /jffs/syslog.log
4. Wait for about 3 seconds
5. ls /jffs/syslog.log (if the file has been recreated, go back to step 3)
6. cd /tmp
7. mount -o remount,ro,noatime /jffs
8. mount | grep jffs (should show ro,noatime in brackets)
9. reboot


After rebooting check the following:

1. ls /jffs/syslog.log (should not exist)
2. mount | grep jffs (should show ro,noatime in brackets)


Remember, if you need to install or make changes to anything on /jffs you will need to temporarily mount the /jffs partition read-write, make the changes and then mount /jffs readonly:

1. mount -o remount,rw,noatime /jffs
2. make any changes to /jffs partition
3. rm /jffs/syslog.log
4. Wait for about 3 seconds
5. ls /jffs/syslog.log (if the file has been recreated, go back to step 3)
6. cd /tmp
7. mount -o remount,ro,noatime /jffs
8. mount | grep jffs (should show ro,noatime in brackets)
9. reboot


This keeps me happy knowing that nothing can write to the /jffs partition without me allowing it.

 

[Rexcellent]

Building upon the "mount /jffs read/only" idea.

Hi Everyone,

As requested in another thread, I'm building on user2k10's idea to mount the /jffs partition read/only. I really liked the idea of preserving the flash memory on my RT-AC68U, but I also like the idea of preserving long-term syslog data.

To that end, I've added the following to my post-mount script:
Important note: Your path will most likely be different from mine; specifically, the "8GB_USB" mounted device.
Edit accordingly.

#!/bin/sh

if ! [ -d /tmp/mnt/8GB_USB/rwjffs ]; then

   # One-time setup of new jffs directory
   mkdir /tmp/mnt/8GB_USB/rwjffs

   # Copy the data
   cp -fr /jffs/* /tmp/mnt/8GB_USB/rwjffs/

fi;

# Re-mount /jffs to r/w usb drive
mount -o rbind /tmp/mnt/8GB_USB/rwjffs /jffs

Recognizing the need to keep the real /jffs directory in sync with my new writeable jffs directory, I created a new subdirectory called /tmp/mnt/8GB_USB/rwjffs/myscripts, and wrote the following script called push2jffs:
Important note: Don't forget to change the permissions by running:
chmod 755 /tmp/mnt/8GB_USB/rwjffs/myscripts/push2jffs

#!/bin/sh

ScriptDirName=`dirname $0`
BADScriptPath="/jffs/myscripts"

if [ "$ScriptDirName" != "$BADScriptPath" ] && [ "$PWD" != "$BADScriptPath" ]; then

   # unmount usb r/w instance of /jffs
   umount /jffs

   # unmount flash r/o instance of /jffs if it is mounted
   [B]# make sure this is the correct block device for your flash memory[/B]
   umount /dev/mtdblock5

   # mount the real /jffs as r/w
   if ! [ -d /tmp/realjffs ]; then mkdir /tmp/realjffs; fi;
   mount -t jffs2 -o rw,noatime /dev/mtdblock5 /tmp/realjffs

   # copy the files to the real /jffs
   cp /tmp/mnt/8GB_USB/rwjffs/scripts/* /tmp/realjffs/scripts/
   cp /tmp/mnt/8GB_USB/rwjffs/configs/* /tmp/realjffs/configs/

   # re-mount usb instance of /jffs
   umount /tmp/realjffs
   rmdir /tmp/realjffs
   mount -o rbind /tmp/mnt/8GB_USB/rwjffs /jffs

   echo "Done."

else

   echo "Working directory and/or script path matches $BADScriptPath. We can't have that."

fi;

Very Important Note: While I have much experience in batch scripting, I have less experience in shell scripting. While these scripts work for me, I know that there is almost no error checking, or logging. I invite everyone to comment, criticize, and otherwise help me improve on this.

Thanks

 

[SVettel]

Just put in /jffs a symlink to /tmp/syslog.sys, if just want to disable it.

 

[josh.zyman]

Just put in /jffs a symlink to /tmp/syslog.sys, if just want to disable it.

It does not work with the symlink. The link is rewritten by the log file.
Please try this before giving it as advice.

 

[Chrysalis]

this has been working reasonably well until I rebooted.

When I rebooted the router I lost 4 days of logs, it goes from 5 august straight to 9th.

so this is in cron

0 * * * * /jffs/scripts/syslog-rotate.sh #syslog-rotate#

and the script

#! /bin/sh

#set SYSLOG Directory
SYSLOGDIR=/tmp/mnt/OPTWARE/logs/
cd $SYSLOGDIR


# Rotate Logs if syslog.log-1 exists
if [ -s syslog.log-1 ]; then 

# SET i to one less than the number of logs to keep.  (i.e. "8" means 9 old logs will be kept)
for i in $(awk 'BEGIN { for ( i=8; i>0; i-- ) { print i; } }');
do if [ -f syslog.$i.log ]; then mv syslog.$i.log syslog.$(($i+1)).log; fi;
done
mv syslog.log-1 syslog.1.log
fi

I also have syslog-move.sh

#!/bin/sh
#
logger RedirectingSyslogd to USB

# Syslog.log source file
SOURCE=/tmp/syslog.log

# Syslog.log target file
SYSLOG=/tmp/mnt/OPTWARE/logs/syslog.log

#Stop existing syslogd
killall syslogd

# Add lines from tmp syslog to USB syslog and create symlink

if [ ! -L $SOURCE ]; then
cat $SOURCE >> $SYSLOG
# delete tmp syslog file
rm $SOURCE
# create symbolic link
ln -s $SYSLOG $SOURCE
fi

#restart syslogd with 4 MB file limit and log rotation enabled
syslogd -m 0 -S -O $SYSLOG -s 4096 -l 7 -b 1

#add cron job to rotate logs

if [ -s /jffs/scripts/syslog-rotate.sh ]; then
cru a syslog-rotate "0 * * * * /jffs/scripts/syslog-rotate.sh"
fi

any idea why from these scripts would I lose 4 days on a reboot?

 

[Ronv42]

I took a more simple apprach to keep syslog from going to JFFS

I too was concerned about the log being sent to JFFS. I looked into all the options as everyone else did here and came up with a simple approach. Just change the directory where syslog is logged. I did it with a services-start script in the /jffs/scripts directory:

#!/bin/sh
touch /tmp/000services-start
/usr/bin/killall syslogd
mkdir /tmp/log
syslogd -m 0 -S -O /tmp/log/syslog.log -s 256 -l 7
rm /tmp/syslog*

Now the only log that is put into JFFS is at router startup. So you only get a write of the syslog to JFFS when you reboot the router.

 

[wollyka]

I too was concerned about the log being sent to JFFS. I looked into all the options as everyone else did here and came up with a simple approach. Just change the directory where syslog is logged. I did it with a services-start script in the /jffs/scripts directory:

#!/bin/sh
touch /tmp/000services-start
/usr/bin/killall syslogd
mkdir /tmp/log
syslogd -m 0 -S -O /tmp/log/syslog.log -s 256 -l 7
rm /tmp/syslog*

Now the only log that is put into JFFS is at router startup. So you only get a write of the syslog to JFFS when you reboot the router.

It seems that by doing so, the log will not appear on the router web interface

Edit: i refered to the following thread http://forums.smallnetbuilder.com/showthread.php?t=8217&page=2 and put the following thanks to 000111 and joegreat

#!/bin/sh
SOURCE=/tmp/syslog.log    # original source of the syslog
SYSLOG=/tmp/mnt/RECOVERY/Syslog/syslog.log    # destination of the syslog - need to by adjusted

/usr/bin/killall syslogd

syslogd -m 0 -S -O /tmp/mnt/RECOVERY/Syslog/syslog.log -s 256 -l 7

NOW=$(date +"%Y%m%d-%H%M%S")    # current date and time

# mv $SYSLOG $SYSLOG-$NOW    # rename the previous log with timestamp
# cp $SOURCE $SYSLOG    # copy current syslog to the new location
cat $SOURCE >> $SYSLOG
rm $SOURCE    # delete the syslog
ln -s $SYSLOG $SOURCE   # create a symbolic link from the orginal syslog to the copied one
if [ "$?" -ne 0 ]    # check for error
then
echo "Error in Syslog move! Script: $0"    # display the error message
exit $?
else
echo "Syslog move OK. Script: $0"    # display OK message
exit 0
fi

Let's see if it works and survive reboots

Edit2: it still writes to /jffs so i added the following to init-start

/usr/bin/logger -t $(basename $0) "started [$@]"

# Remount /jffs partition readonly
mount -o remount,ro,noatime /jffs

/usr/bin/logger -t $(basename $0) "finished [$@]"

 

[Ronv42]

It seems that by doing so, the log will not appear on the router web interface

True it no longer shows up in the web interface. I compromised with SSH into the router if I needed to read it.

 

[Shonk]

I simply compile it for my ac66u with JFFS2LOG=n
job done

 

[tomsk]

Ello folks.... excuse me for resurrecting a dinosaur thread... but after replacing syslog with syslog-ng, i noticed that the router GUI reflected the only the log entries since last "messages" log file rotation. I have a symbolic link from the original syslog.log location to the messages log (default syslog-ng log)
From earlier posts it seemed like if the copy of syslog in the jffs partition was disabled, the log readout in the GUI would stop working. Is whats displayed in the GUI being read from /tmp/syslog.log or from /jffs/syslog.log?

 

[Asad Ali]

I might, it's just not a high priority at this point.

Hi Eric, is disabling the router logs possible today, or that feature is still not implemented?

 

[RMerlin]

No change there, no.

 

[Asad Ali]

Ok thanks for replying.

 

[bengalih]

So old thread, but figured I didn't need to start a new one as this is all seemingly valid.

My RT-AC68U is getting on in years, and I still plan to keep it around for a bit I was getting worried enough to finally try and mitigate the /jffs write cycle. I basically followed the general advice above.

In my init script I remount /jffs as read only as suggested by @user2k10. This prevents any syslog (or any) writes during boot.
Then, in a post-mount script I also did something very similar to @Rexcellent except that I also keep my true /jffs partition mounted to an alternate location. I keep this as read/write because nothing will ever write to it except when I choose.
This avoided some issues with unmounting /jffs to do the "push/sync" operations.

Now, when my router is up I modify my /jffs like normal (except it is really redirected to my /ext4).
If I make changes I have a script which does an rsync mirror back to the "true" jffs mount.

About half the user scripts execute before pre-mount (inclusive) and half execute after post-mount (inclusive), so you don't even need to always sync you files back to the true /jffs unless you have executed one that happens too early in boot process.

thanks again for the ideas, and hope mine help someone as well.