Scribe Issues with scribe.... Errors all over the place after restarting scribe!

[SomeWhereOverTheRainBow]

scribe restart

                            _
                         _ ( )
       ___    ___  _ __ (_)| |_      __
     /',__) /'___)( '__)| || '_`\  /'__`\
     \__, \( (___ | |   | || |_) )(  ___/
     (____/`\____)(_)   (_)(_,__/'`\____)
     syslog-ng and logrotate installation
     v3.2_0 (master)    Coded by cmkelley


 syslog-ng NOT running!  Starting  ...
 Starting syslog-ng...              done.
 Restarting uiScribe ...Error parsing config, syntax error, unexpected LL_FLOAT, expecting end of file in /opt/etc/syslog-ng.conf:1:1-1:4:
1-----> 4.2
1-----> ^^^
2       4.2
3       4.2
4       4.2
5       4.2
6       4.2


syslog-ng documentation: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
contact:
        GitHub Project: https://github.com/syslog-ng/syslog-ng
        Chat with the Developers: https://gitter.im/syslog-ng/syslog-ng
        Mailing List: https://lists.balabit.hu/mailman/listinfo/syslog-ng
[2023-12-07T21:23:44.029665] ERROR: configuration files without a version number have become unsupported in syslog-ng 3.13, please specify a version number using @version as the first line in the configuration file;
Mounting WebUI page for uiScribe

Mounted uiScribe WebUI page as Main_LogStatus_Content.asp


      checking syslog-ng daemon ... dead.
    the system logger (syslogd) ... is not running!

    Type syslog-ng -Fevd at shell prompt or select sd
    from scribe utilities menu (su) to view syslog-ng
    debugging data.
    syslog.log default location ... /jffs/syslog.log
  ... & agrees with config file ... okay!

 checking system for necessary scribe hooks ...

          checking S01syslog-ng ... present.
            checking post-mount ... present.
               checking unmount ... present.

 checking syslog-ng configuration ...

   syslog-ng.conf version check ... out of sync! ()
 *** Updating syslog-ng.conf and restarting syslog-ng ***
 Checking syslog-ng...              dead.
sed: bad option in substitution expression
 Starting syslog-ng...              done.
 Restarting uiScribe ...Error parsing config, syntax error, unexpected LL_FLOAT, expecting end of file in /opt/etc/syslog-ng.conf:1:1-1:4:
1-----> 4.2
1-----> ^^^
2       4.2
3       4.2
4       4.2
5       4.2
6       4.2


syslog-ng documentation: https://www.syslog-ng.com/technical-documents/list/syslog-ng-open-source-edition
contact:
        GitHub Project: https://github.com/syslog-ng/syslog-ng
        Chat with the Developers: https://gitter.im/syslog-ng/syslog-ng
        Mailing List: https://lists.balabit.hu/mailman/listinfo/syslog-ng
[2023-12-07T21:23:45.889218] ERROR: configuration files without a version number have become unsupported in syslog-ng 3.13, please specify a version number using @version as the first line in the configuration file;
Mounting WebUI page for uiScribe

Mounted uiScribe WebUI page as Main_LogStatus_Content.asp

         syslog-ng.conf version ... updated! (4.2)
    syslog-ng.conf syntax check ... FAILED!


          scribe installed version: v3.2_0 (master)
             scribe GitHub version: v3.2_0 (master)
                    scribe is up to date!

The first indicator I had to tell me syslog-ng was having issues was Skynet would not start. It would fail because syslog-ng kept getting killed. After removing scribe, issue with skynet went away.

 

[SomeWhereOverTheRainBow]

Well, I uninstalled scribe. Issue is now gone.

 

[Viktor Jaep]

Well, I uninstalled scribe. Issue is now gone.

Wow, that's a weird crash... did you happen to have a look at /opt/etc/syslog-ng.conf, and see if you could fix whatever entry in there was causing it to freak out?

 

[SomeWhereOverTheRainBow]

Wow, that's a weird crash... did you happen to have a look at /opt/etc/syslog-ng.conf, and see if you could fix whatever entry in there was causing it to freak out?

It wasn't like I edited it, syslog-ng was using the default configuration that comes with scribe.

https://www.snbforums.com/threads/scribe-3-x_y-syslog-ng-and-logrotate-installer.84720/post-879514

 

[Ripshod]

I don't see that anything else has changed in a while now so possibly some storage/file corruption?
Do you have BACKUPMON installed? Try a new drive with a backup from a couple of days previous to this?
Just throwing it out there.

 

[elorimer]

I don't know why this happens, but I know what happens. syslog-ng.conf has a line that describes the version installed, and syslog-ng uses that to deprecate some features. There are not many features relevant here. Scribe as part of its startup checks to see that the line in the .conf file matches the installed version of syslog-ng, but if it doesn't, it changes the line in syslog-ng.conf to match the installed version, for reasons that are not much more than silencing a warning. Syslog-ng is updated in entware to 4.2, so scribe tries to update the .conf to 4.2. Something in that logic is off, though, as it changes every line to 4.2. That overwrites everything, including the definition of the messages destination, and isn't a valid line to begin with, so when syslog-ng starts it throws every error under the sun.

But it doesn't always do this.

The solution is to restore an old .conf file, or reinstall. After you reinstall, you might copy .conf to something like .conf.old so you can just change the name and restart.

 

[dave14305]

Something in that logic is off, though, as it changes every line to 4.2.

It would be good if @cmkelley would validate that sng_conf_vers is not empty before running the sed to update the config file.

scribe/scribe at eb111ad19ccb7be118660ae7d67e868ecff31426 · cynicastic/scribe

Entware syslog-ng and logrotate installer for Asuswrt-Merlin - cynicastic/scribe

github.com

 

[elorimer]

As far as I know what he has was working from around 3.13 through 3.31 to 4.1. What about 4.2 is now breaking, and how might testing for empty avert this?

I think the default syslog-ng.conf installed by entware starts with @version: 4.1

Syslog-ng installed by entware I think carries version 4.2.0-1, and I think reports its version as 4.2.0

/tmp/home/root# syslog-ng -V
syslog-ng 4 (4.2.0)
Config version: 4.2
Installer-Version: 4.2.0
Revision:
Compile-Date: Sep  1 2023 19:09:45
Module-Directory: /opt/lib/syslog-ng
Module-Path: /opt/lib/syslog-ng
Include-Path: /opt/share/syslog-ng/include
Available-Modules: add-contextual-data,linux-kmsg-format,tags-parser,azure-auth-header,pseudofile,affile,map-value-pairs,rate-limit-filter,examples,cryptofuncs,secure-logging,cef,csvparser,basicfuncs,syslogformat,hook-commands,appmodel,json-plugin,afstomp,correlation,disk-buffer,stardate,regexp-parser,afsocket,kvformat,tfgetent,confgen,graphite,http,metrics-probe,xml,timestamp,afprog,afuser,system-source
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: off
Enable-TCP-Wrapper: off
Enable-Linux-Caps: off
Enable-Systemd: off

So, if I follow, the lines @dave14305 highlighted would report the conf version as 4.1 and the installed version as 4.2, triggering the sed of the config file. Earlier it might have been 3.18 and 4.2, triggering a sed of the config file to change the version line from 3.18 to 4.2.

 

[SomeWhereOverTheRainBow]

As far as I know what he has was working from around 3.13 through 3.31 to 4.1. What about 4.2 is now breaking, and how might testing for empty avert this?

I think the default syslog-ng.conf installed by entware starts with @version: 4.1

Syslog-ng installed by entware I think carries version 4.2.0-1, and I think reports its version as 4.2.0

/tmp/home/root# syslog-ng -V
syslog-ng 4 (4.2.0)
Config version: 4.2
Installer-Version: 4.2.0
Revision:
Compile-Date: Sep  1 2023 19:09:45
Module-Directory: /opt/lib/syslog-ng
Module-Path: /opt/lib/syslog-ng
Include-Path: /opt/share/syslog-ng/include
Available-Modules: add-contextual-data,linux-kmsg-format,tags-parser,azure-auth-header,pseudofile,affile,map-value-pairs,rate-limit-filter,examples,cryptofuncs,secure-logging,cef,csvparser,basicfuncs,syslogformat,hook-commands,appmodel,json-plugin,afstomp,correlation,disk-buffer,stardate,regexp-parser,afsocket,kvformat,tfgetent,confgen,graphite,http,metrics-probe,xml,timestamp,afprog,afuser,system-source
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: off
Enable-TCP-Wrapper: off
Enable-Linux-Caps: off
Enable-Systemd: off

So, if I follow, the lines @dave14305 highlighted would report the conf version as 4.1 and the installed version as 4.2, triggering the sed of the config file. Earlier it might have been 3.18 and 4.2, triggering a sed of the config file to change the version line from 3.18 to 4.2.

Thank you guys for taking the time to look into this. I can see this being a problem if the script is killing the local klogd or syslogd, and syslog-ng is failing to start. @elorimer I am pretty sure this is what was causing the bug with AdGuardHome failing to start. --- No syslog agent to report when syslogd, klogd, or syslog-ng are not available. I definitely hope there is a clean way to handle. So far, you and @dave14305 are on the right track here.