Scribe Logs stop updating after a while

[amoney]

I have seen this a few times where logs are no longer getting updated. After reboot everything is fine. For example here are entries from messages when i rebooted

Dec 19 00:00:58 RT-AC88U-BC40 dnsmasq-dhcp[28068]: DHCPACK(wl0.2) 192.168.3.207 90:03:b7:f6:53:3d             
Dec 22 08:19:14 RT-AC88U-BC40 uiScribe: Mounting WebUI page for uiScribe                                       
Dec 22 08:19:14 RT-AC88U-BC40 uiScribe: Mounted uiScribe WebUI page as Main_LogStatus_Content.asp

Similarly openvpn log. I was restarting vpn client and notcing the log was not getting updated and then rebooted the device 12/22 8:19 and the log started getting updates.

Dec 18 23:51:16 RT-AC88U-BC40 ovpn-client1[27976]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Dec 18 23:51:16 RT-AC88U-BC40 ovpn-client1[27976]: Control Channel: TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, peer certificate: 4096 bit RSA, signature: RSA-SHA256
Dec 22 08:19:22 RT-AC88U-BC40 openvpn-routing: Routing mbp from 192.168.1.219 to any through ovpnc1

I confirmed i have space left on the device

Filesystem                Size      Used Available Use% Mounted on
/dev/root                32.3M     32.3M         0 100% /
devtmpfs                251.4M         0    251.4M   0% /dev
tmpfs                   251.6M      1.1M    250.5M   0% /tmp
/dev/mtdblock4           64.0M      3.5M     60.5M   6% /jffs
/dev/sda1                14.8G    206.7M     13.8G   1% /tmp/mnt/merlin
tmpfs                   251.6M      1.1M    250.5M   0% /www/require/modules/menuTree.js
/dev/mtdblock4           64.0M      3.5M     60.5M   6% /www/Main_LogStatus_Content.asp
arpit@RT-AC88U-BC40:/tmp/home/root#

Running:
RT-AC88U: 386.3.2
YazFi v4.3.4
scribe v2.4.3
uiScribe v1.4.5


Anyone seen this and have pointers on what could be going on?

 

[elorimer]

I've seen syslog-ng not start, but not start and then stop. My suggestion would be to watch it and if it stops again, look at a couple of things:

1. SSH into the router and run scribe statusto see if syslog-ng is running.
2. SSH into the router and see if /tmp/syslog.log is filling up because syslogd started running. That's unlikely to me.
3. Look in messages to see what the last messages might be before it stops.

By the way, scribe ordinarily writes to /opt/var/log/messages, not /opt/var/log/messages.log. Did you change it?

 

[amoney]

Regarding messages log file. I just typed .log without realizing. Its actually logging in /opt/var/log/messages. Will fix post.

I ran scribe status right now and looks like configs and links got updated

checking system for necessary scribe hooks ...

          checking S01syslog-ng ... updated. 
         checking service-event ... present. 
            checking post-mount ... present. 
               checking unmount ... present. 
    checking logrotate cron job ... present. 
       checking directory links ... updated. 

 checking syslog-ng configuration ...

   syslog-ng.conf version check ... out of sync! (3.33) 
 *** Updating syslog-ng.conf and restarting syslog-ng *** 
 Checking syslog-ng...              alive. 
 Shutting down syslog-ng...              done. 
 Starting syslog-ng...              done. 
 Restarting uiScribe ...Mounting WebUI page for uiScribe

Mounted uiScribe WebUI page as Main_LogStatus_Content.asp

            done. 
         syslog-ng.conf version ... updated! (3.35) 
    syslog-ng.conf syntax check ... okay! 

          scribe installed version: v2.4_3 (master) 
             scribe GitHub version: v2.4_3 (master) 
                    scribe is up to date!

/tmp/syslog.log is a link for me so it should have enough space as its on the mounted USB

ls -lh /tmp/syslog.log
lrwxrwxrwx    1 arpit    root          21 Dec 22 10:01 /tmp/syslog.log -> /opt/var/log/messages

Thanks for the info. Will check these out next time i see issue with logging.