Router is either crashing or wifi is cutting out

[jorgsmash]

Last night I had maybe 3 occurrences where it seemed like my wifi dropped. The first occurrence I unplugged my ISP router (ATT fiber router, Wifi Disabled, Passthrough mode enabled directly to my AX88U), and my main router (AX88U) and mesh node (AX58U). I did this maybe 8pm because we were streaming a show and it cut out and said it was a connection issue. Later that night it cut out again, and when I looked at my phone I wasn't connected to wifi. It was either the router is crashing and rebooting, or wifi is cutting out.


So I hopped in the GUI to look at the syslog. I saved the syslog from last night, but the issue just happened again maybe 15 minutes ago, so I grabbed that syslog as well. I've attached them both.

Could anyone see if the router is crashing and help me figure out why? One thing I've always been concerned about with my AX88U is memory. I'm always at 95% utilization so maybe something is pushing it up to 100% and the router is crashing.

Here's the custom add-ons I'm using. Diversion is disabled since I switched to AdGuardHome.

 1  open     Diversion     v4.3.2   -> v4.3.3
 2  open     Skynet                    v7.4.3

 7  open     unbound Manager            v3.22

 j3 open     scMerlin                  v2.4.0

 j7 open     YazDHCP                   v1.0.5
 vn open     vnStat                    v2.0.4
 rt open     RTRMON                     v1.54

 ag open     AdGuardHome               v1.6.0

 ep manage   Entware packages

 sw manage   Swap file /mnt/sda5 2.0G

 i  show     all available scripts or tools
 u  check    for script updates

    amtm options
 e  exit      t  theme   r  reset   a  about

Thanks all.

 

[ColinTaylor]

It seems suspicious that there are no messages at all prior to the syslogd started in either log file. There is no indication that the router crashed so it looks more like a deliberate reboot or a power off/on.

Also suspicious is that fact that starting at midnight Skynet was blocking connections to dns.adguard.com. But that might be because you want to block DoT and DoH there.

 

[jorgsmash]

It seems suspicious that there are no messages at all prior to the syslogd started in either log file. There is no indication that the router crashed so it looks more like a deliberate reboot or a power off/on.

Also suspicious is that fact that starting at midnight Skynet was blocking connections to dns.adguard.com. But that might be because you want to block DoT and DoH there.

It's just me and my wife in the house, watching a show and the internet cuts out. I wasn't deliberately rebooting or powering it off. The first time it happened I did go unplug the router. The second time it happened, I was in bed. Netflix cut out and wifi dropped on my phone. I didn't get out of bed to go turn anything off or reboot anything. I just logged into the GUI on my phone and saved the syslog. So is it rebooting on it's own? Since the syslog is getting wiped and we are only seeing when it boots up? Can I set something up to save syslog so it survives reboots?

Yes I saw those outbound blocks too, and I whitelisted that IP. I'm using some outbound malware blocklist that blocks things that I have to investigate and whitelist if needed. I do use AGH so I'm not trying to block that.

 

[ColinTaylor]

I would start by doing a controlled reboot using the button in the GUI. When it comes back up check to see if you still have entries in the syslog from prior to that reboot.

Have you ever installed Scribe on this router?

 

[jorgsmash]

I would start by doing a controlled reboot using the button in the GUI. When it comes back up check to see if you still have entries in the syslog from prior to that reboot.

Have you ever installed Scribe on this router?

I think I installed scribe a very long time ago but never configured it and since have removed it. Should I use it?

 

[ColinTaylor]

Should I use it?

No. I was just wondering whether that was the cause of the missing log entries.

 

[jorgsmash]

Syslog does not survive a reboot when initiated from the GUI. It just starts over. Furthermore, before I just rebooted, my router was reporting an uptime of 2 hours. I have not rebooted the router today for a fact (before 10 minutes ago), but I did experience the issue described above today.

 

[ColinTaylor]

Can you check that your /jffs partition isn't full.

 

[dave14305]

I think I installed scribe a very long time ago but never configured it and since have removed it.

Just check if any remnants by running:

ls -ld /jffs/syslog*

They should not be directories.

 

[ATLga]

Can you check that your /jffs partition isn't full.

Maybe related to the bad asus update a couple weeks ago

 

[jorgsmash]

Just check if any remnants by running:

ls -ld /jffs/syslog*

They should not be directories.

It appears they are directories

RT-AX88U-F610:/tmp/home/root# ls -ld /jffs/syslog*
drwxrwxrwx    2 jorg     root             0 Jun  9 12:25 /jffs/syslog.log
drwxrwxrwx    2 jorg     root             0 Jun  9 12:25 /jffs/syslog.log-1
RT-AX88U-F610:/tmp/home/root#

 

[jorgsmash]

Can you check that your /jffs partition isn't full.

I doubt it is. But is there a command I can run to check that? Or in the GUI?

 

[dave14305]

It appears they are directories

RT-AX88U-F610:/tmp/home/root# ls -ld /jffs/syslog*
drwxrwxrwx    2 jorg     root             0 Jun  9 12:25 /jffs/syslog.log
drwxrwxrwx    2 jorg     root             0 Jun  9 12:25 /jffs/syslog.log-1
RT-AX88U-F610:/tmp/home/root#

Run:

rmdir /jffs/syslog.log
rmdir /jffs/syslog.log-1

Then you should see the regular logs show up within 30 seconds or so (can’t remember exactly).

But something is creating them so you might want to review your custom scripts.

grep mkdir /jffs/scripts/*
grep mkdir /opt/etc/init.d/*

 

[jorgsmash]

Run:

rmdir /jffs/syslog.log
rmdir /jffs/syslog.log-1

Then you should see the regular logs show up within 30 seconds or so (can’t remember exactly).

But something is creating them so you might want to review your custom scripts.

grep mkdir /jffs/scripts/*
grep mkdir /opt/etc/init.d/*

Ok I removed those directories, and here is the output of your other commands:

RT-AX88U-F610:/tmp/home/root# grep mkdir /jffs/scripts/*
/jffs/scripts/YazDHCP:          mkdir -p "$SCRIPT_DIR"
/jffs/scripts/YazDHCP:          mkdir -p "$SHARED_DIR"
/jffs/scripts/YazDHCP:          mkdir -p "$SCRIPT_WEBPAGE_DIR"
/jffs/scripts/YazDHCP:          mkdir -p "$SCRIPT_WEB_DIR"
/jffs/scripts/dn-vnstat:                mkdir -p "$SCRIPT_DIR"
/jffs/scripts/dn-vnstat:                mkdir -p "$SCRIPT_STORAGE_DIR"
/jffs/scripts/dn-vnstat:                mkdir -p "$IMAGE_OUTPUT_DIR"
/jffs/scripts/dn-vnstat:                mkdir -p "$CSV_OUTPUT_DIR"
/jffs/scripts/dn-vnstat:                mkdir -p "$SHARED_DIR"
/jffs/scripts/dn-vnstat:                mkdir -p "$SCRIPT_WEBPAGE_DIR"
/jffs/scripts/dn-vnstat:                mkdir -p "$SCRIPT_WEB_DIR"
/jffs/scripts/dn-vnstat:                        mkdir -p "/opt/share/$SCRIPT_NAME.d/"
/jffs/scripts/dn-vnstat:                        mkdir -p "/jffs/addons/$SCRIPT_NAME.d/"
/jffs/scripts/dn-vnstat:        mkdir -p "$tmpoutputdir"
/jffs/scripts/firewall:mkdir -p /tmp/skynet/lists
/jffs/scripts/firewall:mkdir -p /jffs/addons/shared-whitelists
/jffs/scripts/firewall: mkdir -p /tmp/skynet/lists
/jffs/scripts/firewall:                 mkdir -p "${skynetloc}/webui/stats"
/jffs/scripts/firewall:                                 mkdir -p "/www/user/skynet"
/jffs/scripts/firewall:         mkdir -p "${skynetloc}/lists"
/jffs/scripts/firewall:                 mkdir -p "${skynetloc}/webui"
/jffs/scripts/firewall:         mkdir -p "${device}/skynet"
/jffs/scripts/firewall:         mkdir -p "${skynetloc}/webui"
/jffs/scripts/rtrmon.sh:                mkdir -p "/jffs/addons/rtrmon.d"
/jffs/scripts/rtrmon.sh:            mkdir -p "/root/.config/ookla"
/jffs/scripts/scmerlin:         mkdir -p "$SCRIPT_DIR"
/jffs/scripts/scmerlin:         mkdir -p "$SHARED_DIR"
/jffs/scripts/scmerlin:         mkdir -p "$SCRIPT_WEBPAGE_DIR"
/jffs/scripts/scmerlin:         mkdir -p "$SCRIPT_WEB_DIR"
RT-AX88U-F610:/tmp/home/root# grep mkdir /opt/etc/init.d/*
/opt/etc/init.d/rc.func.syslog-ng:        mkdir /jffs/syslog.log /jffs/syslog.log-1
RT-AX88U-F610:/tmp/home/root#

 

[dave14305]

/opt/etc/init.d/rc.func.syslog-ng: mkdir /jffs/syslog.log /jffs/syslog.log-1

Sounds like Scribe wasn’t cleanly uninstalled. Remove this file to at least get your logs working properly again.

rm /opt/etc/init.d/rc.func.syslog-ng

 

[jorgsmash]

Sounds like Scribe wasn’t cleanly uninstalled. Remove this file to at least get your logs working properly again.

rm /opt/etc/init.d/rc.func.syslog-ng

Ok I'll run that. Also, here's whats in /opt/etc/init.d/

/tmp/mnt/sda5/entware/etc/init.d# ls -la
drwxr-xr-x    2 jorg     root          4096 May 12 10:46 .
drwxr-xr-x   13 jorg     root          4096 May 10 11:42 ..
-rwxr-xr-x    1 jorg     root           195 Dec  1  2022 S01syslog-ng
-rwxr-xr-x    1 jorg     root           382 May 12 10:46 S02haveged
-rwxr-xr-x    1 jorg     root          1460 May 10 11:42 S33vnstat
-rwxr-xr-x    1 jorg     root          1380 May 12 10:46 S61unbound
-rwxr-xr-x    1 jorg     root          1699 May  9 22:39 S80pixelserv-tls
-rwxr-xr-x    1 jorg     root           534 May  9 22:41 S99AdGuardHome
-rwxr-xr-x    1 jorg     root          1380 Oct  5  2022 back.S61unbound
-rw-r--r--    1 jorg     root          2822 Mar 23  2020 rc.func
-rw-r--r--    1 jorg     root          3597 Oct  9  2022 rc.func.AdGuardHome
-rw-r--r--    1 jorg     root          2547 Oct  5  2022 rc.func.div
-rw-r--r--    1 jorg     root          1145 Feb 25  2022 rc.func.syslog-ng
-rwxr-xr-x    1 jorg     root           966 Mar 23  2020 rc.unslung
jorg@RT-AX88U-F610:/tmp/mnt/sda5/entware/etc/init.d#

# cat S01syslog-ng
#!/bin/sh

ENABLED=yes
PROCS=syslog-ng
ARGS=""
PREARGS=""
DESC=$PROCS
PATH=/opt/sbin:/opt/bin:/opt/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

. /opt/etc/init.d/rc.func
jorg@RT-AX88U-F610:/tmp/mnt/sda5/entware/etc/init.d#

 

[dave14305]

S01syslog-ng

I’d remove this as well since you don’t believe you still use Scribe.

 

[jorgsmash]

I’d remove this as well since you don’t believe you still use Scribe.

I'd be willing to use it if it provides some benefit.

 

[dave14305]

I'd be willing to use it if it provides some benefit.

Look what it’s done so far in trying to troubleshoot your spontaneous reboot issue.

 

[jorgsmash]

Look what it’s done so far in trying to troubleshoot your spontaneous reboot issue.

Lol yeah forgot the main topic of the thread. So now I'm assuming that if I experience the issue again, my syslog won't get reset?