Unexpected behavior of /jffs/syslog.log

[ryandesign]

I'm using asuswrt merlin 382.1_2 on an ASUS RT-AC3100. During the configuration process I've often needed to check the syslog.log file. I was in /jffs editing my scripts and configs, found syslog.log there, and assumed that's where the router puts it. But I had trouble using it. "tail -f /jffs/syslog.log" did not work as I expected; the last lines of the log were shown, but new entries were not. Given all the other peculiarities of busybox, I assumed its "tail -f" was broken; this thread started out as a bug report about that. I also observed that the log often seemed to be delayed; I assumed the router was caching log entries in memory before writing them to the log.

Only now, months later, I've realized that the real syslog.log is actually in /tmp. "tail -f /tmp/syslog.log" works fine and entries show up there immediately. /tmp/syslog.log is apparently copied to /jffs/syslog.log once every minute. Presumably /tmp is a temporary ramdisk that's cleared on startup and the log is periodically copied to /jffs for archival purposes. Since the file is being replaced, that's why "tail -f /jffs/syslog.log" didn't work; "tail -F /jffs/syslog.log" does work, to the extent that it does show the minutes-worth of changes when the file is copied.

Now that I understand what's going on, it makes sense, and I will use /tmp/syslog.log for my live log inspection needs. I only wish I had understood it earlier.

 

[RMerlin]

Presumably /tmp is a temporary ramdisk that's cleared on startup and the log is periodically copied to /jffs for archival purposes.

That's correct. /tmp uses tmpfs, so it's located in RAM. This will also reduce the amount of nand rewrites in case of a very busy syslog, as it only gets copied to jffs from time to time. I can't remember the exact frequency.