connmon connmon v3.0.8 [2025-Nov-16] - Internet Connection Monitoring Tool for AsusWRT Merlin

[penguin22]

Appreciate the add for notifications. One question that may just be on my end, however when looking at the charts/data, I see a periodic spike in ping and jitter that doesn't show when performing a comparable test from a client connected on the network. Is this expected or explainable or something that warrants some digging to identify underlying cause:

 

[Ripshod]

Two per hour? Do you use spdMerlin?

 

[Tarek Yag]

Two per hour? Do you use spdMerlin?

I guess you pin-pointed the issue here with a great spot-on notice. I had it once upon a time when I was in the very early days of using both connmon and spdMelrin together.

I used, and always make sure, not to allow any scheduled cron job to run at the same time with any other job (especially connection related). Nowadays, I have 12 cron jobs and there is not a single job gets run with another at the same time. This keeps my ancient router always able to keep up with all the load.

 

[penguin22]

Two per hour? Do you use spdMerlin?

Yes, I do indeed. That was a quick find and in the case they are both running, it never exceeds 40ms, so I just changed the threshold for alerting, along with adjusting the time they run to avoid overlap, similar to what @Tarek Yag indicated.

I am using the built-in speedtest as well, though wonder if there would be a difference running the external test instead. For now, since spdMerlin is set to run every 12 & 42 minutes, I adjusted conmon to every 5 minutes, which (in theory) will prevent them from overlapping.

 

[Tarek Yag]

so I just changed the threshold for alerting

It's up to you to decide on the threshold for alerting, but now that connmon and spdMerlin cron jobs are no longer overlapping, you don't need to take it into consideration anymore, just keep your average internet usage into account for the threshold.

which (in theory) will prevent them from overlapping.

They should not overlap anymore, in theory and in practice, as I believe no speed test takes more than 1 minute. Speedtest's algorithm is super optimal from what I experienced through the years.

I am using the built-in speedtest as well, though wonder if there would be a difference running the external test instead.

I once answered this doubt, which I had for a long time too. People always wonder the same thing!

https://www.snbforums.com/threads/spdmerlin-v4-4-16-2025-nov-16-internet-speedtest-and-monitoring-tool-for-asuswrt-merlin.94829/post-959033

 

[penguin22]

I once answered this doubt, which I had for a long time too. People always wonder the same thing!

https://www.snbforums.com/threads/spdmerlin-v4-4-16-2025-nov-16-internet-speedtest-and-monitoring-tool-for-asuswrt-merlin.94829/post-959033

The way I read that, use the external to ensure it is the most current. Interesting to me, and likely others, as the way it is written in the configuration page almost makes it sound like a completely different binary rather than the same speedtest at just a different version:

Speedtest binary to use
(either built-in Ookla or speedtest-cli)

 

[penguin22]

I can confirm that ensuring the cron jobs being offset did resolve the erroneous spikes I was seeing.

 

[Tarek Yag]

That was a great quick catch by @Ripshod
@penguin22, you missed giving him a like on his discovery post #22 he totally deserves it, and it helps!

 

[penguin22]

That was a great quick catch by @Ripshod
@penguin22, you missed giving him a like on his discovery post #22 he totally deserves it, and it helps!

Agreed, great catch! I think in my excitement that I double liked, which took it away. Fixed that now though. I'm also awake now and will test the debug log adjustments too.

 

[penguin22]

New thought, since I can envision people using conmon and spdMerlin together in many instances, it would likely be good for both add-ons to have a check for the other and give option to coordinate cron job scheduling to avoid one other.

In my case, it was as simple as setting conmon to every 5 min vs 3 min since it will never run at the same time as spdMerlin, though I can imagine this or another add-on that could help with cron job scheduling. Sadly, it's above my skillset, though I am putting it out into the ether should this be something someone wanted to consider.

 

[Tarek Yag]

though I can imagine this or another add-on that could help with cron job scheduling. Sadly, it's above my skillset, though I am putting it out into the ether should this be something someone wanted to consider.

Thank you for your suggestion!

Actually, right now I have already made 5 powerful separate mini scripts for my personal use within my own setup, but I've been actively developing them over the past couple of months as a continuous learning project. Although, they all started as a single or a few command scripts a year ago or so, they got developed driven by needs and new ideas over time. I already standardized and modularized them for future public use, again, for learning purposes only so far.

And yes, one of my mini scripts include a cron jobs check and verification script, that now could easily have your new idea implemented into it as a core feature. To be honest, this idea sparked exactly from your use case, and it already popped into my mind hours ago, but again, no promises for now.

I'm already excited to create a script project that gathers all my mini scripts into a single powerful Merlin addon, which provides them as multiple tools, but I don't feel it's time yet as I have other priorities I have to stick with for the time being.

 

[penguin22]

Thank you for your suggestion!

Actually, right now I have already made 5 powerful separate mini scripts for my personal use within my own setup, but I've been actively developing them over the past couple of months as a continuous learning project. Although, they all started as a single or a few command scripts a year ago or so, they got developed driven by needs and new ideas over time. I already standardized and modularized them for future public use, again, for learning purposes only so far.

And yes, one of my mini scripts include a cron jobs check and verification script, that now could easily have your new idea implemented into it as a core feature. To be honest, this idea sparked exactly from your use case, and it already popped into my mind hours ago, but again, no promises for now.

I'm already excited to create a script project that gathers all my mini scripts into a single powerful Merlin addon, which provides them as multiple tools, but I don't feel it's time yet as I have other priorities I have to stick with for the time being.

All of this sounds excellent!

Following your feedback earlier, I read the information and examples of Scribe, which I will look into setting up something for hostapd logs similar to what you helped with for DomainVPNRouting. One thing I noticed is the potential need and separate steps required for logrotate support. From what I gather, just adding the Scribe support for splitting the logs does not natively enable log rotation.

Many moons ago, I recall working on an Oracle environment with Tomcat that ground to a halt and would take nearly an hour to come back online. Turned out that the Tomcat logs had grown to over 2GB, which had to be processed and appended each start. Once we found this and added proper log maintenance scheduled tasks, things immediately started working perfectly.

I bring this up only as I can imagine similar occurring with noisy logs if log rotate isn't put in place at the same time as separation.

 

[Ripshod]

Scribe (syslog-ng) rotates logs daily by default, at 5vminutes past midnight

 

[penguin22]

Scribe (syslog-ng) rotates logs daily by default, at 5vminutes past midnight

While I know it does log rotate by default, I believe, per the readme, that you have to give the guidance for which logs should be rotated.

Some of the files in this directory may be copied to /opt/etc/syslog-ng.d/
to filter common messages from the default messages file to their own
log files.  Note that when copying the files, they must be writable by the
user only, i.e. chmod 600.  If the group or others can write to them, they
will not be loaded by syslog-ng.

It is highly recommended to copy the corresponding file of the same name
in /opt/share/logrotate/examples/ to /opt/etc/logroate.d/ to ensure the
log files do not grow too large.  If there is not corresponding file in
/opt/share/logrotate/examples, then either the file is not intended to be
used permanently (e.g. expandlog); or should generate no or very few log
entries (e.g. blankmsg, errormsg); or its logs are handled by other
programs (e.g. skynet).

 

[scootertramp]

The main logs are already set-up by default. You can add your preferences as needed.
I added wlceventd, meshUSB and hostapd from /opt/share/logrotate/examples/.
The logs excqosspeedtest, excqospingtest, zeromac and dns-monitor I added due to filters
I created to separate their data from the syslog stream.

This is my list of rotated logs.

agagne@rt-be88u:/tmp/mnt/rt-be88u/entware/etc/logrotate.d# ls -ltr
-rw------- 1 agagne root 113 Oct 5 12:26 wlceventd
-rw------- 1 agagne root 100 Oct 5 12:26 syslogng
-rw------- 1 agagne root 136 Oct 5 12:26 messages
-rw------- 1 agagne root 117 Oct 5 12:26 logrotate
-rw------- 1 agagne root 140 Oct 5 12:26 firewall
-rw------- 1 agagne root 375 Oct 5 12:26 A00global
-rw------- 1 agagne root 98 Oct 5 13:27 meshUDB
-rw------- 1 agagne root 107 Oct 5 13:27 hostapd
-rw------- 1 agagne root 119 Oct 5 13:27 excqosspeedtest
-rw------- 1 agagne root 118 Oct 5 13:27 excqospingtest
-rw------- 1 agagne root 98 Oct 6 11:09 zeromac
-rw------- 1 agagne root 143 Nov 6 07:36 dns-monitor

Just to add you can get some of the syslog-ng filters from /opt/share/syslog-ng/examples/ .
Copy them to /opt/etc/syslog-ng.d.

 

[penguin22]

The main logs are already set-up by default. You can add your preferences as needed.
I added wlceventd, meshUSB and hostapd from /opt/share/logrotate/examples/.
The logs excqosspeedtest, excqospingtest, zeromac and dns-monitor I added due to filters
I created to separate their data from the syslog stream.

Just to add you can get some of the syslog-ng filters from /opt/share/syslog-ng/examples/ .
Copy them to /opt/etc/syslog-ng.d.

I added spdMerlin and hostapd, along with corresponding log rotate items and see them functioning as expected:

Nov 20 10:52:41 RT-BE88U logrotate: logrotate state -- version 2
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/wlceventd.log" 2025-11-16-0:5:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/unbound.log" 2025-11-19-0:5:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/messages" 2025-11-20-10:52:32
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/logrotate.log" 2025-11-15-0:0:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/syslog-ng.log" 2025-11-16-0:5:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/spdmerlin.log" 2025-11-20-10:0:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/hostapd.log" 2025-11-20-10:0:0

The final one that seems chatty enough to warrant a separate log file would be dnsmasq-dhcp[5342], which I imagine the number may change on different routers with different setups. This is the corresponding DHCP requests and acknowledgements, which is normal functionality. This in particular when using Unbound with dnsmasq disabled for DNS resolution. Unless I'm missing it, there is no example for this or it is given a different name.

 

[scootertramp]

I added spdMerlin and hostapd, along with corresponding log rotate items and see them functioning as expected:

Nov 20 10:52:41 RT-BE88U logrotate: logrotate state -- version 2
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/wlceventd.log" 2025-11-16-0:5:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/unbound.log" 2025-11-19-0:5:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/messages" 2025-11-20-10:52:32
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/logrotate.log" 2025-11-15-0:0:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/syslog-ng.log" 2025-11-16-0:5:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/spdmerlin.log" 2025-11-20-10:0:0
Nov 20 10:52:41 RT-BE88U logrotate: "/opt/var/log/hostapd.log" 2025-11-20-10:0:0

The final one that seems chatty enough to warrant a separate log file would be dnsmasq-dhcp[5342], which I imagine the number may change on different routers with different setups. This is the corresponding DHCP requests and acknowledgements, which is normal functionality. This in particular when using Unbound with dnsmasq disabled for DNS resolution. Unless I'm missing it, there is no example for this or it is given a different name.

I believe you are on your own for that filter. Should be easy to filter on dnsmasq-dhcp. Check some of the examples.
Not sure why that seems so chatty. The default for leases on the router is 24 hours(86400).
That's not a DNS resolution thing, it's a DHCP lease time thing.