"out_fd is a pipe" spammed a ton in logs

[zoltan1980]

Do anybody know what may cause such a mess in logs?

May  4 19:37:10 kernel: out_fd is a pipe
May  4 19:37:10 kernel: out_fd is a pipe
May  4 19:37:10 kernel: out_fd is a pipe
May  4 19:37:10 kernel: out_fd is a pipe
May  4 19:37:11 kernel: out_fd is a pipe
May  4 19:37:11 kernel: out_fd is a pipe
May  4 19:37:12 kernel: out_fd is a pipe
May  4 19:37:12 kernel: out_fd is a pipe
May  4 19:37:12 kernel: out_fd is a pipe
May  4 19:37:12 kernel: out_fd is a pipe
May  4 19:37:14 kernel: out_fd is a pipe
May  4 19:37:14 kernel: out_fd is a pipe
May  4 19:37:14 kernel: out_fd is a pipe
May  4 19:37:14 kernel: out_fd is a pipe
May  4 19:37:16 kernel: out_fd is a pipe
May  4 19:37:16 kernel: out_fd is a pipe
May  4 19:37:16 kernel: out_fd is a pipe
May  4 19:37:16 kernel: out_fd is a pipe
May  4 19:37:17 kernel: out_fd is a pipe
May  4 19:37:17 kernel: out_fd is a pipe
May  4 19:37:18 kernel: out_fd is a pipe
May  4 19:37:18 kernel: out_fd is a pipe
May  4 19:37:18 kernel: out_fd is a pipe
May  4 19:37:18 kernel: out_fd is a pipe
May  4 19:37:20 kernel: out_fd is a pipe
May  4 19:37:20 kernel: out_fd is a pipe
May  4 19:37:20 kernel: out_fd is a pipe
May  4 19:37:20 kernel: out_fd is a pipe
May  4 19:37:22 kernel: out_fd is a pipe
May  4 19:37:22 kernel: out_fd is a pipe

This is on official AsusWRT 3.0.0.4.386_51255, Asus RT-AC68U. I've updated to this version some time ago and haven't seen it before, it is visible since few days.
It always starts approximately 4 minutes after the last "normal" log line after reboot, and at the beginning is very regular (four lines every 30 seconds, starting from the full minute), but after some hours it is almost every second.
Unmounting the USB drive (via SSH umount or eject option, no physical disconnect from USB port) doesn't help. I've tried to disable AI Protection and AI Cloud 2.0, but no effect. Tried to kill light_httpd via SSH too.

Please help me to narrow down the issue...

 

[SeriousFamily]

did you upgrade to official from merlin?

take note of this post

[ 386.11alpha Build(s) ] Testing available build(s)

After all post upgrade protocols and multiple reboots of the router/modem combo, I still getting 1 of these each SECOND?? Apr 28 10:43:07 kernel: out_fd is a pipe Apr 28 10:43:07 kernel: out_fd is a pipe Apr 28 10:43:10 kernel: out_fd is a pipe Apr 28 10:43:10 kernel: out_fd is a pipe Apr 28...

www.snbforums.com

 

[zoltan1980]

...yep, I've found it when I googled for the log line. But I rejected it, as I've never used Merlin on my router...

 

[zoltan1980]

...after few days the log spam has gone. Almost. Now I have this every minute:

May  6 13:46:06 kernel: updateservice/305: potentially unexpected fatal signal 4.
May  6 13:46:06 kernel: Pid: 305, comm:        updateservice
May  6 13:46:06 kernel: CPU: 0    Tainted: P             (2.6.36.4brcmarm #1)
May  6 13:46:06 kernel: PC is at 0x5d788
May  6 13:46:06 kernel: LR is at 0x7b2b4
May  6 13:46:06 kernel: pc : [<0005d788>]    lr : [<0007b2b4>]    psr: 20000010
May  6 13:46:06 kernel: sp : beb41d58  ip : cafebabe  fp : 003fef48
May  6 13:46:06 kernel: r10: 005e4d18  r9 : 00000000  r8 : 005e4f30
May  6 13:46:06 kernel: r7 : 00000014  r6 : 00000000  r5 : 00000000  r4 : 00000000
May  6 13:46:06 kernel: r3 : 00000000  r2 : beb41ed4  r1 : beb32198  r0 : 00000000
May  6 13:46:06 kernel: Flags: nzCv  IRQs on  FIQs on  Mode USER_32  ISA ARM  Segment user
May  6 13:46:06 kernel: Control: 10c53c7d  Table: 056e004a  DAC: 00000015
May  6 13:47:06 kernel: updateservice/537: potentially unexpected fatal signal 4.
May  6 13:47:06 kernel: Pid: 537, comm:        updateservice
May  6 13:47:06 kernel: CPU: 0    Tainted: P             (2.6.36.4brcmarm #1)
May  6 13:47:06 kernel: PC is at 0x5d788
May  6 13:47:06 kernel: LR is at 0x7b2b4
May  6 13:47:06 kernel: pc : [<0005d788>]    lr : [<0007b2b4>]    psr: 20000010
May  6 13:47:06 kernel: sp : be8b3d58  ip : cafebabe  fp : 003fef48
May  6 13:47:06 kernel: r10: 005e4d18  r9 : 00000000  r8 : 005e4f30
May  6 13:47:06 kernel: r7 : 00000014  r6 : 00000000  r5 : 00000000  r4 : 00000000
May  6 13:47:06 kernel: r3 : 00000000  r2 : be8b3ed4  r1 : be8a4198  r0 : 00000000
May  6 13:47:06 kernel: Flags: nzCv  IRQs on  FIQs on  Mode USER_32  ISA ARM  Segment user
May  6 13:47:06 kernel: Control: 10c53c7d  Table: 9e64404a  DAC: 00000015

Signal 4 is SIGILL, when CPU gets an unknown instruction. What could it be...? In updateservice? I'm guessing it's a process for firmware update, so it shouldn't rather have unexpected CPU instructions...

 

[SeriousFamily]

I seen someone say that update service for signal 11 is something to do with trend macro. somwhere on this forum.

the log they posted was very simler just saying signal 11 not 4.

 

[StrikerXXX]

I have the same router as the owner of the topic, I'm on merlin beta .11 firmware. In my case it does not show this error from the owner of the topic, can I go back to the official asuswrt without problems?

I'm not liking this beta version of merlin, .11, it's very unstable.

 

[zoltan1980]

I seen someone say that update service for signal 11 is something to do with trend macro. somwhere on this forum.

the log they posted was very simler just saying signal 11 not 4.

Thanks for the tip, but it's probably not the case. I withdrawed sharing the information in administration/privacy tab (which turns off everything regarding to the Trend Micro/AI Protection) but id doesn't help...

 

[Tech9]

Do you know how to check available NVRAM in SSH?

This router runs low on NVRAM and when it's full you get unable to save settings, reboots, disconnects, errors in logs.

 

[zoltan1980]

size: 57934 bytes (7602 left)
931 nc_setting_conf
636 custom_clientlist
577 rc_support
346 dhcp_staticlist
244 webdav_smb_pc
205 wl1_chansps
194 wl0_maclist_x
193 wl_maclist_x
191 wl0_maclist
190 wl_maclist
174 qos_rulelist
164 subnet_rulelist
122 wl1_maclist_x
119 wl1_maclist
117 dnspriv_rulelist
112 vlan_rulelist
92 acc_list
92 1:pa5ga2
92 1:pa5ga1
92 1:pa5ga0

Probably not the case - 7602 bytes left... :/

By the way - what are those entries witx _x at the end?

 

[RMerlin]

...after few days the log spam has gone. Almost. Now I have this every minute:

Looks like malware. PM sent.

 

[Techpat]

Hi everybody! Just made an account since this was the only forum i could find that had any posts on this (except for some Chinese ones, but i don't read/speak Chinese so...).

I'm worried that this is malware running on my system, been thinking about installing Merlin instead, but I don't have much free time, especially no free time where the family won't give me the evil eye for downtime on the main router...

I've had several occurrences of this as well leading to system crashes and purged loggs. Running Asus own firmware ver. 3.0.0.4.380_7743.

Does anyone here know how to stop it?

#First entry in logg is:
May 13 11:50:55 kernel: out_fd is a pipe
May 13 11:50:55 kernel: out_fd is a pipe
May 13 11:50:59 kernel: out_fd is a pipe
May 13 11:50:59 kernel: out_fd is a pipe

 #etc until

May 13 14:01:31 kernel: out_fd is a pipe
May 13 14:01:31 kernel: out_fd is a pipe

#System crash occurred, date reset for some reason(?).
#Startup initiated, I cut most away. Tell me if you need it!

Aug  1 02:00:17 syslogd started: BusyBox v1.17.4
Aug  1 02:00:17 kernel: klogd started: BusyBox v1.17.4 (2017-06-01 23:40:39 CST)
Aug  1 02:00:17 kernel: Linux version 2.6.36.4brcmarm (root@asus) (gcc version 4.5.3 (Buildroot 2012.02) ) #1 SMP PREEMPT Thu Jun 1 23:49:59 CST 2017

#Etc. etc.
#And then it starts again after startup is completed.

May 13 14:10:11 kernel: out_fd is a pipe
May 13 14:10:11 kernel: out_fd is a pipe

#I cut away alot of the logg entries, it's just repeating the same over and over.
#Only one thing stands out:
May 13 13:48:07 pptpd[943]: MGR: initial packet length 19783 outside (0 - 220)

#Then out_fd keeps going until the system is flodded!

 

[bbunge]

Hi everybody! Just made an account since this was the only forum i could find that had any posts on this (except for some Chinese ones, but i don't read/speak Chinese so...).

I'm worried that this is malware running on my system, been thinking about installing Merlin instead, but I don't have much free time, especially no free time where the family won't give me the evil eye for downtime on the main router...

I've had several occurrences of this as well leading to system crashes and purged loggs. Running Asus own firmware ver. 3.0.0.4.380_7743.

Does anyone here know how to stop it?

Will post logg paste in next post bcs of character lim.

What router are you using? The firmware version, if correct, is very old. An upgrade to the firmware may be in order first with a factory reset and reconfigure. The family will have to wait as it is a security measure.

 

[Techpat]

What router are you using? The firmware version, if correct, is very old. An upgrade to the firmware may be in order first with a factory reset and reconfigure. The family will have to wait as it is a security measure.

It's an RT-AC87U, should have included this from the start. The strange thing is that it might have been a while since i upgraded the firmware, but not more than 2 years, which makes the reported fw ver. strange.

Edit:
Last fw update was Feb 19 2022 to version RT-AC87U_3.0.0.4_382_52545-ga0245cc
(thanks to being to lazy to clean out my main system!)
What the hell is going on!? How can it run this fw version?

 

[ColinTaylor]

It's an RT-AC87U, should have included this from the start. The strange thing is that it might have been a while since i upgraded the firmware, but not more than 2 years, which makes the reported fw ver. strange.

That firmware (3.0.0.4.380_7743) is five years old with known security issues. Install the most recent firmware followed by a hard reset and manually configure it.

RT-AC87U - Support

www.asus.com

[Wireless Router] ASUS router Hard Factory Reset - Method 1 | Official Support | ASUS Global

 

[Techpat]

Thx ColinTaylor & bbunge!

Will do as advised.

Can someone please tell me how the router might have reverted to an earlier version of the fw?

 

[ColinTaylor]

Can someone please tell me how the router might have reverted to an earlier version of the fw?

Possibly when you tried to install the new firmware the update process failed (it happens sometimes) and you didn't notice. You would have had to log back into the GUI and check the firmware version otherwise you would not have been aware of the failure.

 

[Techpat]

Possibly when you tried to install the new firmware the update process failed (it happens sometimes) and you didn't notice. You would have had to log back into the GUI and check the firmware version otherwise you would not have been aware of the failure.

Thx, i'll make sure to double check this time (facepalm)...

 

[Techpat]

Hey, since I need to install new fw, would I be better of just installing Merlin from the start?

 

[L&LD]

Yes.

 

[Tech9]

Hey, since I need to install new fw, would I be better of just installing Merlin from the start?

No, use the latest available Asuswrt instead and plan router upgrade.

RT-AC87U - Support

www.asus.com

This router has no more Asuswrt-Merlin support. The last available version is about 3-years old.

Asuswrt-Merlin - Browse /RT-AC87U/Release at SourceForge.net

Alternative firmware for Asus wireless routers

sourceforge.net