What's new

Scribe Logging stopped - for no reason

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

CaptnDanLKW

Senior Member
Since 386.2_2 things have been stable with my setup since a fresh install with the latest. I've ignored my router for 4-5 days, I went in this morning just to scan the logs and see if any issues were logged.
Logging Stopped 5 days ago. So frustrating.
I was away on Saturday, we had a number of power outages but my equipment is on battery backup, nothing rebooted. I suspect the ISP equipment at the street also went down since the logs show eth0 bounce a number of times, probably when the Arris Cable modem ran its internal reconnect routines causing the ethernet link to bounce, as indicated by the logs.


Code:
Apr 24 13:53:16 RTAC86U kernel: eth0 (Int switch port: 3) (Logical Port: 3) Link DOWN.
Apr 24 13:53:25 RTAC86U kernel: eth0 (Int switch port: 3) (Logical Port: 3) Link UP 1000 mbps full duplex
Apr 24 13:53:29 RTAC86U kernel: eth0 (Int switch port: 3) (Logical Port: 3) Link DOWN.
Apr 24 13:53:37 RTAC86U DualWAN: skip single wan wan_led_control - WANRED off
Apr 24 13:53:42 RTAC86U WAN_Connection: WAN(0) link down.
Apr 24 13:53:48 RTAC86U kernel: eth0 (Int switch port: 3) (Logical Port: 3) Link UP 1000 mbps full duplex
Apr 24 13:53:52 RTAC86U WAN_Connection: WAN(0) link up.
Apr 24 13:53:52 RTAC86U rc_service: wanduck 1054:notify_rc restart_wan_if 0
Apr 24 13:53:52 RTAC86U custom_script: Running /jffs/scripts/service-event (args: restart wan_if)
Apr 24 13:53:52 RTAC86U wsdd2[10693]: error: wsdd-mcast-v4: wsd_send_soap_msg: send
Apr 24 13:53:53 RTAC86U wsdd2[10693]: error: wsdd-mcast-v4: wsd_send_soap_msg: send
Apr 24 13:53:53 RTAC86U wan: finish adding multi routes
Apr 24 13:53:54 RTAC86U start_ddns: update WWW.ASUS.COM update@asus.com, wan_unit 0
Apr 24 13:53:54 RTAC86U inadyn[14171]: In-a-dyn version 2.8.1 -- Dynamic DNS update client.
Apr 24 13:53:59 RTAC86U BWDPI: fun bitmap = 47f
Apr 24 13:54:00 RTAC86U wsdd2[10693]: Terminated received.
Apr 24 13:54:00 RTAC86U wsdd2[10693]: terminating.
Apr 24 13:54:01 RTAC86U Samba_Server: smb daemon is stopped
Apr 24 13:54:01 RTAC86U Samba_Server: daemon is started
Apr 24 13:54:01 RTAC86U wsdd2[14394]: starting.
Apr 24 13:54:33 RTAC86U sd-idle-2.6[1692]: spinning down /dev/sdb after 30 mins 31 secs
Apr 24 13:54:50 RTAC86U WAN_Connection: WAN was restored.
Apr 24 13:54:50 RTAC86U rc_service: wanduck 1054:notify_rc stop_ntpd
Apr 24 13:54:50 RTAC86U rc_service: wanduck 1054:notify_rc start_ntpd
Apr 24 13:54:50 RTAC86U rc_service: waitting "stop_ntpd" via wanduck ...
Apr 24 13:54:50 RTAC86U custom_script: Running /jffs/scripts/service-event (args: stop ntpd)
Apr 24 13:54:50 RTAC86U ntpd: Stopped ntpd
Apr 24 13:54:51 RTAC86U custom_script: Running /jffs/scripts/service-event (args: start ntpd)
Apr 24 13:54:51 RTAC86U ntpd: Started ntpd
Apr 24 13:56:22 RTAC86U kernel: nf_conntrack: expectation table full
Apr 24 13:56:27 RTAC86U kernel: net_ratelimit: 20 callbacks suppressed
Apr 24 13:56:27 RTAC86U kernel: nf_conntrack: expectation table full
Apr 24 13:56:28 RTAC86U kernel: nf_conntrack: expectation table full
Apr 24 23:59:02 RTAC86U dn-vnstat: dn-vnstat relies on Diversion to send email summaries, and Diversion is not installed
Apr 24 23:59:02 RTAC86U dn-vnstat: Diversion can be installed using amtm

ps shows this:
1619610253311.png


so I guess syslog-ng died but the scribe script shows the daemon is still alive

1619610307994.png


And after running 's' status
1619610474102.png


And logging started again

Code:
Apr 28 07:44:40 RTAC86U kernel: xxxxxxxxx not mesh client, can't update it's ip
Apr 28 07:44:40 RTAC86U kernel: xxxxxxxxx not mesh client, can't update it's ip


TL;DR - Logging died for no reason, looks like syslog-ng failed. Simply checking its status 'fixed' it.
Any ideas?
 
I had this happen once about a week ago, but it hasn't happened since. One thing that I'm seeing in the syslog-ng section is a warning, not sure how to resolve it though
WARNING: Configuration file format is too old, syslog-ng is running in compatibility mode. Please update it to use the syslog-ng 3.31 format at your time of convenience. To upgrade the configuration, please review the warnings about incompatible changes printed by syslog-ng, and once completed change the @version header at the top of the configuration file; config-version='3.27'
 
Since 386.2_2 things have been stable with my setup since a fresh install with the latest. I've ignored my router for 4-5 days, I went in this morning just to scan the logs and see if any issues were logged.
Logging Stopped 5 days ago. So frustrating.
I was away on Saturday, we had a number of power outages but my equipment is on battery backup, nothing rebooted. I suspect the ISP equipment at the street also went down since the logs show eth0 bounce a number of times, probably when the Arris Cable modem ran its internal reconnect routines causing the ethernet link to bounce, as indicated by the logs.


Code:
Apr 24 13:53:16 RTAC86U kernel: eth0 (Int switch port: 3) (Logical Port: 3) Link DOWN.
Apr 24 13:53:25 RTAC86U kernel: eth0 (Int switch port: 3) (Logical Port: 3) Link UP 1000 mbps full duplex
Apr 24 13:53:29 RTAC86U kernel: eth0 (Int switch port: 3) (Logical Port: 3) Link DOWN.
Apr 24 13:53:37 RTAC86U DualWAN: skip single wan wan_led_control - WANRED off
Apr 24 13:53:42 RTAC86U WAN_Connection: WAN(0) link down.
Apr 24 13:53:48 RTAC86U kernel: eth0 (Int switch port: 3) (Logical Port: 3) Link UP 1000 mbps full duplex
Apr 24 13:53:52 RTAC86U WAN_Connection: WAN(0) link up.
Apr 24 13:53:52 RTAC86U rc_service: wanduck 1054:notify_rc restart_wan_if 0
Apr 24 13:53:52 RTAC86U custom_script: Running /jffs/scripts/service-event (args: restart wan_if)
Apr 24 13:53:52 RTAC86U wsdd2[10693]: error: wsdd-mcast-v4: wsd_send_soap_msg: send
Apr 24 13:53:53 RTAC86U wsdd2[10693]: error: wsdd-mcast-v4: wsd_send_soap_msg: send
Apr 24 13:53:53 RTAC86U wan: finish adding multi routes
Apr 24 13:53:54 RTAC86U start_ddns: update WWW.ASUS.COM update@asus.com, wan_unit 0
Apr 24 13:53:54 RTAC86U inadyn[14171]: In-a-dyn version 2.8.1 -- Dynamic DNS update client.
Apr 24 13:53:59 RTAC86U BWDPI: fun bitmap = 47f
Apr 24 13:54:00 RTAC86U wsdd2[10693]: Terminated received.
Apr 24 13:54:00 RTAC86U wsdd2[10693]: terminating.
Apr 24 13:54:01 RTAC86U Samba_Server: smb daemon is stopped
Apr 24 13:54:01 RTAC86U Samba_Server: daemon is started
Apr 24 13:54:01 RTAC86U wsdd2[14394]: starting.
Apr 24 13:54:33 RTAC86U sd-idle-2.6[1692]: spinning down /dev/sdb after 30 mins 31 secs
Apr 24 13:54:50 RTAC86U WAN_Connection: WAN was restored.
Apr 24 13:54:50 RTAC86U rc_service: wanduck 1054:notify_rc stop_ntpd
Apr 24 13:54:50 RTAC86U rc_service: wanduck 1054:notify_rc start_ntpd
Apr 24 13:54:50 RTAC86U rc_service: waitting "stop_ntpd" via wanduck ...
Apr 24 13:54:50 RTAC86U custom_script: Running /jffs/scripts/service-event (args: stop ntpd)
Apr 24 13:54:50 RTAC86U ntpd: Stopped ntpd
Apr 24 13:54:51 RTAC86U custom_script: Running /jffs/scripts/service-event (args: start ntpd)
Apr 24 13:54:51 RTAC86U ntpd: Started ntpd
Apr 24 13:56:22 RTAC86U kernel: nf_conntrack: expectation table full
Apr 24 13:56:27 RTAC86U kernel: net_ratelimit: 20 callbacks suppressed
Apr 24 13:56:27 RTAC86U kernel: nf_conntrack: expectation table full
Apr 24 13:56:28 RTAC86U kernel: nf_conntrack: expectation table full
Apr 24 23:59:02 RTAC86U dn-vnstat: dn-vnstat relies on Diversion to send email summaries, and Diversion is not installed
Apr 24 23:59:02 RTAC86U dn-vnstat: Diversion can be installed using amtm

ps shows this:
View attachment 33464

so I guess syslog-ng died but the scribe script shows the daemon is still alive

View attachment 33465

And after running 's' status
View attachment 33466

And logging started again

Code:
Apr 28 07:44:40 RTAC86U kernel: xxxxxxxxx not mesh client, can't update it's ip
Apr 28 07:44:40 RTAC86U kernel: xxxxxxxxx not mesh client, can't update it's ip


TL;DR - Logging died for no reason, looks like syslog-ng failed. Simply checking its status 'fixed' it.
Any ideas?
It may because of the entware updates at about the same time as your logging stopped (if you updated entware). I missed that logging had stopped for a couple of days, and did the same as you - all back to normal.
 
Checking status scribe noticed that the .conf was outdated. It updated that line in the .conf file and restarted syslog-ng so that's why it started logging again.
 
Thanks for this hint, I did a scribe status check from a terminal window, and the .conf file was update and issue resolved for me!
 
Just be aware that this flag in the .conf file isn't all that important. If the conf flag shows that the installed version is less than what syslog-ng is at, syslog-ng operates at the lower level. All scribe is doing is noticing that the .conf file is at a lower level and changing what is in the .conf file so that syslog-ng doesn't throw that error. That change-like the change in the network drivers-could be important, but scribe will just bulldoze it.
 

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top