System Log to USB disk

[RdeN]

Hi,

I would like to save the system log to the USB drive which I have connected to my RT-N66U. Is this possible?

I have already the traffic log being saved to external drive. Btw, I have set it to save it on an hourly basis. But it seems that it is overwriting the previous one, instead of adding another file with a different timestamp as filename.

Thanks,


Ramon

 

[RMerlin]

You will have to kill the syslog service, and re-start it with a different path.

syslogd -m 0 -S -O /your/usb/disk/syslog.log -s 256 -l 7

run "syslogd -h" to see the available options. One of them will allow log rotation.

 

[fritsp1989]

syslogd

Sure i tried this with a startup script in jffs and it work,
But how would i be able to just let it copy to usb instead of replacing the whole syslogd because i cannot view the system logs in the explorer anymore

 

[RMerlin]

Sure i tried this with a startup script in jffs and it work,
But how would i be able to just let it copy to usb instead of replacing the whole syslogd because i cannot view the system logs in the explorer anymore

Create a symlink in /tmp pointing back to the HDD file (delete the old log first):

rm /tmp/syslog.log
ln -s /mnt/sda1/syslog.log /tmp/syslog.log

 

[joegreat]

The symlink works fine, but...

Create a symlink in /tmp pointing back to the HDD file (delete the old log first):

The symlink works fine, but how to make this solution "permanent"?
After reboot the syslog.log is recreated on /tmp.

Thank you for wour kind support!

With kind regards
Joe

 

[RMerlin]

The symlink works fine, but how to make this solution "permanent"?
After reboot the syslog.log is recreated on /tmp.

Thank you for wour kind support!

With kind regards
Joe

Put the commands into the services-start script.

 

[joegreat]

Script to move syslog to usb drive

Put the commands into the services-start script.

Hi,

OK. I did some googel-ing and put together the following script (stored into /jffs/scripts/) to move syslog to an usb drive (or in my case to the internal sd-card).
It preservers also the old syslog files by renaming them on boot: This is very, very helpful in case of debugging of problems...

#!/bin/sh
#
# Syslog.log source file
SOURCE=/tmp/syslog.log

# Syslog.log target file
SYSLOG=/tmp/mnt/your-usb-drive/Syslog/syslog.log

# Get current date and time
NOW=$(date +"%Y%m%d-%H%M%S")

# Rename last syslog with current date
mv $SYSLOG $SYSLOG-$NOW

# copy current syslog file
cp $SOURCE $SYSLOG

# delete current syslog file
rm $SOURCE

# create symbolic link
ln -s $SYSLOG $SOURCE

The target directory shows in my case the following files:

-rw-rw-rw- 1 admin root 44373 Jan 11 21:04 syslog.log
-rw-rw-rw- 1 admin root 43502 Jan 11 20:58 syslog.log-20130111-205948

The current syslog has the default name and the "old one" is renamed with the boot date and time.

Any updates or suggestions are very welcome!

With kind regards
Joe

 

[RMerlin]

You will also probably need to restart or signal syslog, as mentionned in a previous post.

 

[psychosb]

Hi,

OK. I did some googel-ing and put together the following script (stored into /jffs/scripts/) to move syslog to an usb drive (or in my case to the internal sd-card).
It preservers also the old syslog files by renaming them on boot: This is very, very helpful in case of debugging of problems...



The target directory shows in my case the following files:

The current syslog has the default name and the "old one" is renamed with the boot date and time.

Any updates or suggestions are very welcome!

With kind regards
Joe

Joe, how do you configured the script to run automatically on the router boot?

Thanks

 

[joegreat]

Joe, how do you configured the script to run automatically on the router boot?

Hi,

I created a post-mount script in /jffs/scripts with this content:

[B]#!/bin/sh[/B]
[B]/bin/sleep 3s[/B]    # give the disk 3 sec to really be ready
[B]/usr/bin/logger -t START_$(basename $0) "started [$@]"[/B]    # Log the start of the script int syslog.log
[B]SCRLOG=/tmp/$(basename $0).log[/B]    # define the own log file for this script
[B]touch $SCRLOG [/B]  # create my own log file for the messages of this script
[B]echo "START_$(basename $0) started [$@]" >> $SCRLOG[/B]    # log the start message
[B]if [ $1 = "/tmp/mnt/[COLOR="Red"]sdcard[/COLOR]" ][/B]    # check if the USB drive is mounted (need to have you own name)
[B]then
/jffs/scripts/syslog-move.sh >> $SCRLOG[/B]    # Start the script to move Syslog
[B]wait[/B]    # wait for the script to finish
[B]fi
if [ "$?" -ne 0 ][/B]    # If error in the execution of the syslog-move script
[B]then
echo "Error in postmount execution! Script: $0" >> $SCRLOG[/B]    # Log the error
[B]else
echo "Postmount execution OK. Script: $0" >> $SCRLOG[/B]    # Log the success
[B]fi
/usr/bin/logger -t STOP_$(basename $0) "return code $?"[/B]   # Log that the script has finished into syslog.log

Of corse you need the syslog-move.sh script as well in the /jffs/scripts folder:

[B]#!/bin/sh[/B]
[B]SOURCE=/tmp/syslog.log[/B]    # original source of the syslog
[B]SYSLOG=/tmp/mnt/[COLOR="Red"]sdcard/Syslog[/COLOR]/syslog.log[/B]    # destination of the syslog - need to by adjusted
[B]NOW=$(date +"%Y%m%d-%H%M%S")[/B]    # current date and time
[B]mv $SYSLOG $SYSLOG-$NOW[/B]    # rename the previous log with timestamp
[B]cp $SOURCE $SYSLOG[/B]    # copy current syslog to the new location
[B]rm $SOURCE[/B]    # delete the syslog
[B]ln -s $SYSLOG $SOURCE[/B]   # create a symbolic link from the orginal syslog to the copied one
[B]if [ "$?" -ne 0 ][/B]    # check for error
[B]then
echo "Error in Syslog move! Script: $0"[/B]    # display the error message
[B]exit $?
else
echo "Syslog move OK. Script: $0"[/B]    # display OK message
[B]exit 0
fi[/B]

And finally do not forget to add the execute flag to the scripts:

[B]chmod a+x /jffs/scripts/*[/B]

Have fun!

With kind regards
Joe

PS.: Do not forget to backup the /jffs/ content on a save place! The next firmware update may erase the /jffs/ file system...

 

[JoeSchmoe007]

I just followed exactly what JoeGreat described in his post dated 03-09-2013, 02:44 AM :

1) Created 2 files in /jffs/scripts folder while making sure I changed path to match my setup.

2) Ran chmod and verified that it worked.

Rebooted router twice but I see no log files on my USB drive. Note that USB drive is visible and traffic logs are saved on it successfully.

Did I miss any required steps?

 

[joegreat]

I just followed exactly what JoeGreat described in his post dated 03-09-2013, 02:44 AM :

1) Created 2 files in /jffs/scripts folder while making sure I changed path to match my setup.

Did I miss any required steps?

Hi Joe,

Can you please post more details what you did? Do you mean 'post-mount' and 'syslog-move.sh'?
Did you edit the 2 files to reflect your path to the USB device? The red marked text in the scripts.

The 'post-mount' script is looging to the /tmp/syslog.log and to /tmp/post-mount.log
Can you please check what's in the two log files?

With kind regards
Joe

 

[JoeSchmoe007]

Hi Joe,

Can you please post more details what you did? Do you mean 'post-mount' and 'syslog-move.sh'?
Did you edit the 2 files to reflect your path to the USB device? The red marked text in the scripts.

The 'post-mount' script is looging to the /tmp/syslog.log and to /tmp/post-mount.log
Can you please check what's in the two log files?

With kind regards
Joe

Yes, I meant 'post-mount' and 'syslog-move.sh'.

Yes, I edited them to reflect path to my USB drive.

I have /tmp/syslog.log that contains log entries.

I do not have /tmp/post-mount.log - I guess this is a part of the problem.

 

[joegreat]

Yes, I meant 'post-mount' and 'syslog-move.sh'.

Yes, I edited them to reflect path to my USB drive.

I have /tmp/syslog.log that contains log entries.

I do not have /tmp/post-mount.log - I guess this is a part of the problem.

Hmmm, can you try to run the syslog-move.sh manually (from command line)?

Then you still will have a /tmp/syslog.log entry but it will be a link to the target location. Something like (using ls -la command):

[B]lrwxrwxrwx[/B]    1 admin    root            33 Mar 30 20:47 syslog.log [B]-> /tmp/mnt/sdcard/Syslog/syslog.log[/B]

Compared to the real file:

[B]-rw-rw-rw-[/B]    1 admin    root         46635 Apr  3 07:19 syslog.log

By the way: How did you edit the files on the router? Which editor did you use?

With kind regards
Joe

 

[kjetilhp]

Hi

I got this working but after when the system rolls the file after some time (or size of the log file) the symlink are gone. Anyway to modify the syslog so the symlink are kept?

 

[tifozi]

If you have entware, a much simpler and easier way to manage syslog is by installing the logrotate package. This is an adapted guide from the wl500g steps.

opkg install logrotate

I have reconfigured most of my logs to get written in /opt/var/log including syslog

mkdir -p /opt/var/log/

create the config file using

vi /opt/etc/logrotate.conf

and paste the following and save it.

# rotate log files weekly
weekly
#daily

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

notifempty
nomail
#olddir /opt/var/log/backup/
missingok
#dateext

# uncomment this if you want your log files compressed
compress

# packages can drop log rotation information into this directory
include /opt/etc/logrotate.d

# no packages own lastlog or wtmp -- we'll rotate them here
#/var/log/wtmp {
#    monthly
#    create 0664 root utmp
#    rotate 1
#}

# system-specific logs may be also be configured here.

/opt/var/log/syslog.log {
size 1024k
weekly
rotate 9
postrotate
killall -HUP syslogd
endscript
}

Restart syslog daemon and start using the new path

/opt/etc/init.d/S05syslogd restart

Setting up cron

Crontab is not retained after reboots. So store tasks in jffs.

vi /jffs/configs/cronjobs

and paste the following line

0 0 * * * admin /opt/sbin/logrotate -f /opt/etc/logrotate.conf &>/dev/null

Add the following to post-mount or init-start and execute it one time for current boot.

### Add cronjobs to crond
crontab -u admin /jffs/configs/cronjobs

 

[kjetilhp]

for some reason I don't have the /opt/etc/init.d/S05syslogd .. is this supposed to be a part of the entware install? my /opt is pointing at tmp/opt that again point at entware..

 

[tifozi]

Thanks for pointing that out. I had created it and completely forgot about it.

vi /opt/etc/init.d/S05syslogd

Paste this code

#!/bin/sh
#
# Startup script for syslog
#
PATH=/opt/bin:/opt/sbin:/opt/local/bin:/sbin:/bin:/usr/bin:/usr/sbin

LOGFILE=syslog.log
KERNLOGFILE=kern.log
LOG_OLD=/tmp
LOG_NEW=/opt/var/log

prefix=""
sbindir=${prefix}/sbin

NAME=syslogd
DAEMON=${sbindir}/${NAME}
DESC="syslogd"
OPTIONS="-m 0 -O $LOG_NEW/$LOGFILE -S -l 7 -s 0"

case "$1" in
start0)
printf "Starting ${DESC}: "
# Copy old syslog and create symlink to new
if [ ! -L /tmp/syslog.log ]; then
cat $LOG_OLD/$LOGFILE >> $LOG_NEW/$LOGFILE
mv $LOG_OLD/$LOGFILE $LOG_NEW/$KERNLOGFILE
ln -s $LOG_NEW/$LOGFILE $LOG_OLD/$LOGFILE
fi
${DAEMON} ${OPTIONS}
printf "${NAME}.\n"
logger -t ${NAME} "started."
;;
stop)
if [ -n "`pidof syslogd`" ]; then
printf "Stopping ${DESC}: "
killall "${NAME}"
printf "${NAME}.\n"
fi
;;
start|restart|force-reload)
$0 stop
sleep 1
$0 start0
;;
*)
printf "Usage: $0 {start|stop|restart|force-reload}\n" >&2
exit
;;
esac

exit 0

Make it executable

chmod +x /opt/etc/init.d/S05syslogd

Since it is located in /opt/etc/init.d you don't have to worry about reboots.

 

[Deleted member 27741]

With the instructions from post #10 I was able to get this to work! So far so good.

#####EDIT#####
I must note that post 10 lacks killing syslog. If you don't kill it, it will still write to /tmp/syslog.log as well as wherever you tell the script to write it (probably on your usb somewhere).
I added the command "killall syslogd" to the script to kill the log before restarting it with command "syslogd -m 0 -S -O /your/usb/disk/syslog.log -s 256 -l 7"
#############

I chose a different philosophy for the syslog files, though. Instead of making a new file on each reboot with a new timestamp, I concatenated the new syslog file onto the old one. I figure the file already has the dates in it, and would rather have a big file than a bunch of little ones accumulalting over time.

I commented out lines 5 and 6 and added a cat command like so (compare to syslog-move.sh in post #10).

# mv $SYSLOG $SYSLOG-$NOW # rename the previous log with timestamp
# cp $SOURCE $SYSLOG # copy current syslog to the new location
cat $SOURCE >> $SYSLOG

 

[errorsys]

#####EDIT#####
I must note that post 10 lacks killing syslog. If you don't kill it, it will still write to /tmp/syslog.log as well as wherever you tell the script to write it (probably on your usb somewhere).
I added the command "killall syslogd" to the script to kill the log before restarting it with command "syslogd -m 0 -S -O /your/usb/disk/syslog.log -s 256 -l 7"
#############

Actually it's not true.
When you look closely there is a symbolic link created, so every change is done on your usb.