The showstopper 'I saw error 'xx' in my logs', now what?

[cmkelley]

Sorry man, my native language ain't English
Are you saying that you also found the entry in your logs at every boot before the system clock is set?

LOL, no, I garbled what I said, it didn't make sense even in (American) English. My brain gets too far ahead of my fingers and words get left out.

I should have just said I see it in my logs during every boot-up, before the clock is set.

 

[Dabombber]

Good idea since most "that's normal, ignore it" responses are buried in release threads.

MMM DD HH:mm:ss kernel: ethX: received packet with own address as source address

This frequently occurs when people have a laptop connected to both wireless and Ethernet at the same time, causing a loop.

MMM DD HH:mm:ss WLCEVENTD: ethX: Disassoc XX:XX:XX:XX:XX:XX
MMM DD HH:mm:ss WLCEVENTD: ethX: Assoc XX:XX:XX:XX:XX:XX

[GUIDE] Troubleshooting wifi issues

Those messages aren't a cause, they are a symptom. They indicate that your clients are disconnecting and reconnecting.

Try the recommended wifi settings:

- Disable Universal/Implicit Beamforming (Explicit is fine)
- Disable Airtime Fairness
- Disable MU-MIMO

MMM DD HH:mm:ss miniupnpd[XXXX]: upnp_event_recv: recv(): Connection reset by peer

This simply indicates that a device using UPNP is no longer there. Just ignore it, it's merely a warning.

MMM DD HH:mm:ss miniupnpd[XXXX]: HTTP Connection from X.X.X.X closed unexpectedly

There's nothing wrong with these expiration messages. They indicate that a port that was forwarded through UPNP hasn't been used for a while, so the mapping expired and was removed my the UPNP daemon. This is the desired behaviour.

THe "Closed unexpectedly" would make me suspect you have a LAN device that's incorrectly interacting with UPNP. This isn't a problem of the router but of whatever program running on that private IP is causing it (BTW, there is no point in hiding the IP of a private LAN IP such as 192.168.x.y - it's not routable and only makes troubleshooting harder).

MMM DD HH:mm:ss kernel: Bad eraseblock XXX at 0xXXXXXXXXXXXX

This is rather common for NAND flash. This is why there is a badblock table, and also some spare blocks available for use by the NAND controller.

MMM DD HH:mm:ss avahi-daemon[XXXX]: WARNING: No NSS support for mDNS detected, consider installing nss-mdns!

There's nothing to fix, those warnings are normal.

 

[RMerlin]

Personally, I think that people who cannot understand a typical Linux syslog shouldn't look at their log unless troubleshooting a specific issue. The Linux kernel for instance throws up a lot of debugging info into that that isn't meant for normal users. Lots of drivers for instance will poke at hardware to determine the capabilities, and log failures to syslog simply to indicate "this hardware feature isn't supported", not to indicate "OMG, something is broken, your device is going to explode, debug me NOW!".

This is the same thing as the Windows Event Log, which contains tons of technical info that isn't meant for the average user. Logged warnings are just meant for troubleshooting, not to determine if your computer is working properly or not.

 

[cmkelley]

Personally, I think that people who cannot understand a typical Linux syslog shouldn't look at their log unless troubleshooting a specific issue. The Linux kernel for instance throws up a lot of debugging info into that that isn't meant for normal users. Lots of drivers for instance will poke at hardware to determine the capabilities, and log failures to syslog simply to indicate "this hardware feature isn't supported", not to indicate "OMG, something is broken, your device is going to explode, debug me NOW!".

This is the same thing as the Windows Event Log, which contains tons of technical info that isn't meant for the average user. Logged warnings are just meant for troubleshooting, not to determine if your computer is working properly or not.

Yeah, exactly this. And then seeing something in the log and posting here with OMG THIS IS A BUG MERLIN MISSED (dcd tainted being the poster child here) without even bothering to search the messages.

Now, I know I'm contributing to the problem by writing the syslog-ng installer, but for me it was (and still is) way more about learning scripting than writing an installer per se. It was just an interesting (to me) project to learn on. And with things like the dcd tainted log, which makes finding anything else really difficult, being able to filter those out helps incredibly when actually using the logs to troubleshoot.

 

[Dabombber]

Personally, I think that people who cannot understand a typical Linux syslog shouldn't look at their log unless troubleshooting a specific issue. The Linux kernel for instance throws up a lot of debugging info into that that isn't meant for normal users. Lots of drivers for instance will poke at hardware to determine the capabilities, and log failures to syslog simply to indicate "this hardware feature isn't supported", not to indicate "OMG, something is broken, your device is going to explode, debug me NOW!".

This is the same thing as the Windows Event Log, which contains tons of technical info that isn't meant for the average user. Logged warnings are just meant for troubleshooting, not to determine if your computer is working properly or not.

That's a fair point but everyone has to start somewhere, and the typical way to learn what a syslog means is looking up the messages. If a thread like this stops 90% of the needless questions about it, then so much the better.

 

[RMerlin]

That's a fair point but everyone has to start somewhere, and the typical way to learn what a syslog means is looking up the messages. If a thread like this stops 90% of the needless questions about it, then so much the better.

It didn't stop the modded TM router users from asking why their firmware flashes failed, even tho the answer is right in an actual thread title - don't even need to search for it, it's right in their face as they enter the forums...

The Linux kernel alone can generate hundreds of different messages that may be interpreted as errors by users. Trying to document them all will be a never-ending task.

 

[faria]

Good idea since most "that's normal, ignore it" responses are buried in release threads.

MMM DD HH:mm:ss kernel: ethX: received packet with own address as source address

RMerlin said: ↑
This frequently occurs when people have a laptop connected to both wireless and Ethernet at the same time, causing a loop.

The above log entry also happen to devices that have no lan ports.
It happens on router models with Smart Connect enabled,
If a wireless client switches from 5Ghz to 2.4Ghz the log entry shows up.
My laptop never been connected via a lan port, well it does not have one ,and according to the logs he is or rather its wireless card is the one causing most of those entries in the log.

 

[GuruGuy]

I think some of the confusion comes from the message itself. Some actually say "WARNING" in the message, others don't have any description at all leading people to think it's a huge ERROR or FAILURE and something must be done right now to fix it

 

[faria]

I think some of the confusion comes from the message itself. Some actually say "WARNING" in the message, others don't have any description at all leading people to think it's a huge ERROR or FAILURE and something must be done right now to fix it

True, here is an example :

kernel: Scratch pad is not initialized.

I found 66 entries in my log of the above, one start to wonder if anything is wrong .
I mean can the router live without its scratch pad

 

[cmkelley]

True, here is an example :

I found 66 entries in my log of the above, one start to wonder if anything is wrong .
I mean can the router live without its scratch pad

Well, getting kernel developers to change warning messages so they're clearer to end users (who, again, they're not really meant for) is about as likely as getting end users reading the "[FAQ] READ ME FIRST before posting a question" sticky at top of the threads list ...

Respectfully, I think you're looking at the problem the wrong way. Is your router functioning fine and doing it's job? If so, you don't need to worry about any kernel messages, they're not going to tell you anything of use, or predict a problem in the future. Don't look at the syslog looking for problems, look at the syslong when there ARE problems.

Just my $.02

 

[faria]

Well, getting kernel developers to change warning messages so they're clearer to end users (who, again, they're not really meant for) is about as likely as getting end users reading the "[FAQ] READ ME FIRST before posting a question" sticky at top of the threads list ...

Respectfully, I think you're looking at the problem the wrong way. Is your router functioning fine and doing it's job? If so, you don't need to worry about any kernel messages, they're not going to tell you anything of use, or predict a problem in the future. Don't look at the syslog looking for problems, look at the syslong when there ARE problems.

Just my $.02

With all the respect...

you don't need to worry about any kernel messages

I only posted about 1 kernel log that bothered me for witch I got my answers, the other one was an observation.
Im not looking for problems when looking at the log, im trying to find why this and that failed.
like yesterday: why did the vpn server was no longer reachable?
because after looking at the "log" I found that the ddns failed to update due to a Stubby related issue.
But most likely this issue was introduced by the "End user" because he did no read The Faq., its assumed.
Or maybe it was new features/changes that were added to the firmware that now requires changes to configuration unknow till someone came across the problem.
Of course if a ominous message keeps showing in the logs you gonna notice it right?

Is your router functioning fine and doing it's job?

In short no, that why im trying to find as much as possible in order to get it into a reliable state.
Thanks

 

[cmkelley]

With all the respect...

you don't need to worry about any kernel messages

I only posted about 1 kernel log that bothered me for witch I got my answers, the other one was an observation.
Im not looking for problems when looking at the log, im trying to find why this and that failed.
like yesterday: why did the vpn server was no longer reachable?
because after looking at the "log" I found that the ddns failed to update due to a Stubby related issue.
But most likely this issue was introduced by the "End user" because he did no read The Faq., its assumed.
Or maybe it was new features/changes that were added to the firmware that now requires changes to configuration unknow till someone came across the problem.
Of course if a ominous message keeps showing in the logs you gonna notice it right?

In short no, that why im trying to find as much as possible in order to get it into a reliable state.
Thanks

Well, right, it wasn't working, so you did need to worry. You had a legit reason to go poking.

I'd bet that most people who posted about the dcd tainted crash only saw it because they clicked on the system log page just to see what was there. They weren't having any problems, but they saw it and freaked out.

 

[DAVID LONG]

Whenever I change anything in the router including flashing new firmware I look at the logs to see if anything has changed since the last time I looked.

If something new is showing up in the logs, my first inclination is that something must be wrong because the log didn't look like that before.

Human nature?

 

[cmkelley]

Whenever I change anything in the router including flashing new firmware I look at the logs to see if anything has changed since the last time I looked.

If something new is showing up in the logs, my first inclination is that something must be wrong because the log didn't look like that before.

Human nature?

IMHO, ( "new" | "different" ) != "wrong"

I've clearly been scripting too long ...

 

[DAVID LONG]

I guess I should have said new error or different error that wasn't there last time I looked.

 

[faria]

Well, right, it wasn't working, so you did need to worry. You had a legit reason to go poking.
thanks

I'd bet that most people who posted about the dcd tainted crash only saw it because they clicked on the system log page just to see what was there. They weren't having any problems, but they saw it and freaked out.

I get you man, and a large percentage of user simply dont bother to read and want answers Now! without
searching. Point in case DCD issue, Merlin even made a joke on the release page.
I saw it all the time when i was a dev/moderator @ xda-develepors (Retired now)
Its always my last resort posting for help, granted sometimes as a person not educated nativly in English one lacks the proper " words" to ask the right questions, therefore not finding the proper results.

 

[sfx2000]

As the title may suggest, I'd like to start a consolidated list of showstopper errors as shown in the system log, if there is interest, of course. Be they security, performance or hardware issues.

Specifically after updating to a new/different firmware, what errors are the most serious (and we should be immediately concerned about) and what errors are simply a different firmware that may just simply be logging at a different log/verbosity level, (and that is less of immediate concern to us, if at all).

Including, if possible, the proper steps or method to deal with and either fix/eliminate them or possibly 'hide' them, as appropriate.

This is almost an impossible task to be honest - devs will insert strings as needed - for debug or code profiling...

Many of them will look really scary - like meltdown day at Fukushima or Chernobyl, but in the real world, not that big of a deal.

Part of the problem is devs, once the code is done and committed, and they've moved on, the debug stuff is still there...

Want to look at something interesting - look at the QSDK for QCA chipsets - if build options are not set right with logmasks, it will happily spew tons of stuff into the logs...

https://wiki.codeaurora.org/xwiki/bin/QSDK/

Marvell and Broadcom are similar here.

Just my thoughts - with ScienceProject, we did try to limit the logging impact for production releases...

 

[sfx2000]

This is the same thing as the Windows Event Log, which contains tons of technical info that isn't meant for the average user. Logged warnings are just meant for troubleshooting, not to determine if your computer is working properly or not.

Hehe - or looking at the MacOS Console logs - everything there looks like OMG, something happened - which it likely did - doesn't mean it was a wrong thing or something broken...

 

[L&LD]

Just a little update on this thread here.

Reading and re-reading all the posts here, I have to concede that I may have greatly underestimated what I could offer the community here.

The votes of support are gratefully received as are the more critical posts which have brought up aspects that I had not thought about when I created this thread initially. Thank you to one and all!

The first show stopper to this 'show stopper' thread is the fact that the replies themselves are limited to a certain maximum number of characters.

The second is that the forum actively blocks certain combinations of characters it recognizes as 'dangerous'.

I hope that we can continue to use this thread as long as it is useful here. But my naive starry-eyed goal of having a single thread of reference for errors may have come to an end here (well, not quite yet, but that 10,000 character limit is very easy to exceed in a single post).

Just wanted to let everyone know why I haven't been actively posting here.

I was thinking about all the above, which is maybe what I should have done first if I had been able to fully understand the scope of what I attempted to accomplish with this thread in the first place.

No worries! It was educational, at the very least.

 

[58chev]

I see the following every 5 minutes in the log. Not sure if it's a real problem or not.
I need to upgrade to the latest but just haven't the time lately.

Apr  8 20:05:01 rc_service: service 3461:notify_rc restart_letsencrypt
Apr  8 20:10:00 rc_service: service 3582:notify_rc restart_letsencrypt
Apr  8 20:15:00 rc_service: service 3708:notify_rc restart_letsencrypt
Apr  8 20:20:00 rc_service: service 3827:notify_rc restart_letsencrypt
Apr  8 20:25:00 rc_service: service 3955:notify_rc restart_letsencrypt
Apr  8 20:30:00 rc_service: service 4076:notify_rc restart_letsencrypt
Apr  8 20:35:00 rc_service: service 4215:notify_rc restart_letsencrypt
Apr  8 20:40:00 rc_service: service 4332:notify_rc restart_letsencrypt
Apr  8 20:45:00 rc_service: service 4458:notify_rc restart_letsencrypt
Apr  8 20:50:00 rc_service: service 4582:notify_rc restart_letsencrypt
Apr  8 20:55:00 rc_service: service 4709:notify_rc restart_letsencrypt
Apr  8 21:00:01 rc_service: service 4846:notify_rc restart_letsencrypt
Apr  8 21:05:01 rc_service: service 5217:notify_rc restart_letsencrypt
Apr  8 21:10:00 rc_service: service 5337:notify_rc restart_letsencrypt
Apr  8 21:15:00 rc_service: service 5466:notify_rc restart_letsencrypt
Apr  8 21:20:00 rc_service: service 5586:notify_rc restart_letsencrypt
Apr  8 21:25:01 rc_service: service 5713:notify_rc restart_letsencrypt
Apr  8 21:30:00 rc_service: service 5832:notify_rc restart_letsencrypt
Apr  8 21:35:01 rc_service: service 5971:notify_rc restart_letsencrypt
Apr  8 21:40:00 rc_service: service 6092:notify_rc restart_letsencrypt
Apr  8 21:45:00 rc_service: service 6220:notify_rc restart_letsencrypt
Apr  8 21:50:00 rc_service: service 6344:notify_rc restart_letsencrypt
Apr  8 21:55:00 rc_service: service 6471:notify_rc restart_letsencrypt
Apr  8 22:00:00 rc_service: service 6596:notify_rc restart_letsencrypt
Apr  8 22:05:01 rc_service: service 6968:notify_rc restart_letsencrypt
Apr  8 22:10:01 rc_service: service 7088:notify_rc restart_letsencrypt