Scribe Scribe v3.2.4 [2025-Nov-22] - Entware syslog-ng and logrotate installer for Asuswrt-Merlin

[Ripshod]

@Martinski

I updated my v3.2.2 to v3.2.3 about a week ago.

Since then I noticed that upon reboot the /opt/var/log/messages file gets disappeared. I get a fresh one after reboot, and all the previous logs are gone.

I tried to fully reinstall scribe v3.2.3 with full replacement - did not help.

Chased the older v3.2.2 version in my back up, and returned these 2 files to the system path:

-rwxr-xr-x 1 admin root 58538 Jul  7 17:50 /jffs/scripts/scribe
-rw-r--r-- 1 admin root 4068 Jul  7 17:50 /opt/etc/init.d/rc.func.syslog-ng

That did not help, /opt/var/log/messages still disappeared after one of the reboots. It stuck after the 1st one, but not the 2nd one.

Other than scribe, I updated pihole last week. And that's all.

Cannot figure out how to fix this. Before the router was rock stable for many months, with the older scribe.

Suggestions?

I wonder.
Are you using a flash drive or an SSD? Flash drives get ficklesome after some use. Logging really does some damage with the constant writes. Ssds also have a finite life, but that life is a lot lot lot longer.

 

[bibikalka]

I wonder.
Are you using a flash drive or an SSD? Flash drives get ficklesome after some use. Logging really does some damage with the constant writes. Ssds also have a finite life, but that life is a lot lot lot longer.

I have an SSD. I thought about checking it for errors, would need to unmount and all.

I did search for more 'Jul 7' files in the backup - nothing seems to be related to scribe other than those 2 files.

 

[Martinski]

@Martinski

I updated my v3.2.2 to v3.2.3 about a week ago.

Since then I noticed that upon reboot the /opt/var/log/messages file gets disappeared. I get a fresh one after reboot, and all the previous logs are gone.

I tried to fully reinstall scribe v3.2.3 with full replacement - did not help.

Chased the older v3.2.2 version in my back up, and returned these 2 files to the system path:

-rwxr-xr-x 1 admin root 58538 Jul  7 17:50 /jffs/scripts/scribe
-rw-r--r-- 1 admin root 4068 Jul  7 17:50 /opt/etc/init.d/rc.func.syslog-ng

That did not help, /opt/var/log/messages still disappeared after one of the reboots. It stuck after the 1st one, but not the 2nd one.

Other than scribe, I updated pihole last week. And that's all.

Cannot figure out how to fix this. Before the router was rock stable for many months, with the older scribe.

Suggestions?

In the post shown below, @visortgw reported seeing a problem where the location of the 'syslog.log' file seems to have gone "missing."

I had a minor glitch with the update on my GT-BE98 Pro. scribe lost track of the syslog.log location. Simple fix was to re-detect it within scribe utilities (su. followed by rd. in the scribe menu).

I later reviewed the code and responded as follows:

OK, thanks for the information. Do you happen to know if the issue can be reproduced consistently?

I reviewed the functions that figure out the original location of the syslog.log file, and there may be some rare situations where the variable holding the path could be erroneously reset to an empty string. The reason is that there was no error checking and handling at all. I have improved the functions to avoid such unusual scenarios. The modified code is currently found only in the 'develop' branch, if you want to give it a try.

/jffs/scripts/scribe develop

Since then, nobody else has reported a similar problem; however, it's possible that what you're seeing now might be related to that same part of the code where the variable may incorrectly be reset to empty.

I'm going to issue the next production release shortly, so perhaps you can update to that newer release and check the results at your next reboot. If the issue persists, hopefully you can capture the entire reboot sequence and post the file for review.

 

[elorimer]

I have only the barest understanding of scripts, so ignore if this is way off base. The startup logic in the helper script is now much more elaborate than it had been. If I follow, when S01 is called, it sources rc.func.syslog-ng, which would ordinarily run in the same process and access the same variables. But rc.func.syslog-ng starts with a shebang, so it would spawn a new process, and not access the same variables. (BTW, what is the "-" in the shebang do?). Does that have something to do with it?

 

[Martinski]

Release Notes for Scribe v3.2.4 production version now available
[2025-Nov-22]

1) IMPROVED: Modified code, including error checking and handling, in functions used to determine the location of the 'syslog.log' file.

[Thanks to @visortgw for pointing out an occurrence where the 'syslog.log' location seems to have gone "missing."]​

2) Miscellaneous code improvements.



The fork from @cmkelley's Scribe add-on is now hosted on the AMTM-OSR GitHub repo:

GitHub - AMTM-OSR/scribe: Entware syslog-ng and logrotate installer for Asuswrt-Merlin

Entware syslog-ng and logrotate installer for Asuswrt-Merlin - AMTM-OSR/scribe

github.com

 

[Martinski]

I have only the barest understanding of scripts, so ignore if this is way off base. The startup logic in the helper script is now much more elaborate than it had been. If I follow, when S01 is called, it sources rc.func.syslog-ng, which would ordinarily run in the same process and access the same variables. But rc.func.syslog-ng starts with a shebang, so it would spawn a new process, and not access the same variables. (BTW, what is the "-" in the shebang do?). Does that have something to do with it?

Sourcing the script doesn't create a child/new process, regardless of the shebang line.

In a POSIX-compliant script, the hyphen '-' as the 1st argument means that's the "end of options" for the shell invocation, so it effectively disables processing of any subsequent command-line options. However, I don't know if it means exactly the same thing for the Ash shell used on Asus routers.

My 2 cents.

 

[scootertramp]

Release Notes for Scribe v3.2.4 production version now available
[2025-Nov-22]

1) IMPROVED: Modified code, including error checking and handling, in functions used to determine the location of the 'syslog.log' file.

[Thanks to @visortgw for pointing out an occurrence where the 'syslog.log' location seems to have gone "missing."]​

2) Miscellaneous code improvements.



The fork from @cmkelley's Scribe add-on is now hosted on the AMTM-OSR GitHub repo:

GitHub - AMTM-OSR/scribe: Entware syslog-ng and logrotate installer for Asuswrt-Merlin

Entware syslog-ng and logrotate installer for Asuswrt-Merlin - AMTM-OSR/scribe

github.com

After update Scribe this morning to v3.2.4 I am getting this message every few minitues.

2025-11-22T07:30:12.000000-05:00 rt-be88u Scribe[-]: kill_logger[24723]: /usr/bin/logger optmsg=[/opt/var/log/messages]
2025-11-22T07:30:12.000000-05:00 rt-be88u Scribe[-]: kill_logger[24723]: /usr/bin/logger syslog_loc=[/jffs/syslog.log]
2025-11-22T07:30:12.000000-05:00 rt-be88u Scribe[-]: kill_logger[24723]: /usr/bin/logger script_conf=[/jffs/addons/scribe.d/config]
2025-11-22T07:30:33.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPREQUEST(br0) 10.215.101.54 d4:5d:64:ce:a1:20
2025-11-22T07:30:33.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPACK(br0) 10.215.101.54 d4:5d:64:ce:a1:20 xt8-down
2025-11-22T07:31:14.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPREQUEST(br0) 10.215.101.240 d8:a9:8b:a4:b4:f0
2025-11-22T07:31:14.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPACK(br0) 10.215.101.240 d8:a9:8b:a4:b4:f0 ring-chime
2025-11-22T07:32:07.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPREQUEST(br0) 10.215.101.87 c4:9d:ed:ec:22:3e
2025-11-22T07:32:07.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPACK(br0) 10.215.101.87 c4:9d:ed:ec:22:3e evolution
2025-11-22T07:32:15.000000-05:00 rt-be88u Scribe[-]: kill_logger[10270]: /usr/bin/logger optmsg=[/opt/var/log/messages]
2025-11-22T07:32:15.000000-05:00 rt-be88u Scribe[-]: kill_logger[10270]: /usr/bin/logger syslog_loc=[/jffs/syslog.log]
2025-11-22T07:32:15.000000-05:00 rt-be88u Scribe[-]: kill_logger[10270]: /usr/bin/logger script_conf=[/jffs/addons/scribe.d/config]

 

[scootertramp]

After update Scribe this morning to v3.2.4 I am getting this message every few minitues.

2025-11-22T07:30:12.000000-05:00 rt-be88u Scribe[-]: kill_logger[24723]: /usr/bin/logger optmsg=[/opt/var/log/messages]
2025-11-22T07:30:12.000000-05:00 rt-be88u Scribe[-]: kill_logger[24723]: /usr/bin/logger syslog_loc=[/jffs/syslog.log]
2025-11-22T07:30:12.000000-05:00 rt-be88u Scribe[-]: kill_logger[24723]: /usr/bin/logger script_conf=[/jffs/addons/scribe.d/config]
2025-11-22T07:30:33.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPREQUEST(br0) 10.215.101.54 d4:5d:64:ce:a1:20
2025-11-22T07:30:33.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPACK(br0) 10.215.101.54 d4:5d:64:ce:a1:20 xt8-down
2025-11-22T07:31:14.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPREQUEST(br0) 10.215.101.240 d8:a9:8b:a4:b4:f0
2025-11-22T07:31:14.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPACK(br0) 10.215.101.240 d8:a9:8b:a4:b4:f0 ring-chime
2025-11-22T07:32:07.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPREQUEST(br0) 10.215.101.87 c4:9d:ed:ec:22:3e
2025-11-22T07:32:07.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPACK(br0) 10.215.101.87 c4:9d:ed:ec:22:3e evolution
2025-11-22T07:32:15.000000-05:00 rt-be88u Scribe[-]: kill_logger[10270]: /usr/bin/logger optmsg=[/opt/var/log/messages]
2025-11-22T07:32:15.000000-05:00 rt-be88u Scribe[-]: kill_logger[10270]: /usr/bin/logger syslog_loc=[/jffs/syslog.log]
2025-11-22T07:32:15.000000-05:00 rt-be88u Scribe[-]: kill_logger[10270]: /usr/bin/logger script_conf=[/jffs/addons/scribe.d/config]

Adding debug info.

 

[Martinski]

After update Scribe this morning to v3.2.4 I am getting this message every few minitues.

2025-11-22T07:30:12.000000-05:00 rt-be88u Scribe[-]: kill_logger[24723]: /usr/bin/logger optmsg=[/opt/var/log/messages]
2025-11-22T07:30:12.000000-05:00 rt-be88u Scribe[-]: kill_logger[24723]: /usr/bin/logger syslog_loc=[/jffs/syslog.log]
2025-11-22T07:30:12.000000-05:00 rt-be88u Scribe[-]: kill_logger[24723]: /usr/bin/logger script_conf=[/jffs/addons/scribe.d/config]
2025-11-22T07:30:33.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPREQUEST(br0) 10.215.101.54 d4:5d:64:ce:a1:20
2025-11-22T07:30:33.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPACK(br0) 10.215.101.54 d4:5d:64:ce:a1:20 xt8-down
2025-11-22T07:31:14.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPREQUEST(br0) 10.215.101.240 d8:a9:8b:a4:b4:f0
2025-11-22T07:31:14.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPACK(br0) 10.215.101.240 d8:a9:8b:a4:b4:f0 ring-chime
2025-11-22T07:32:07.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPREQUEST(br0) 10.215.101.87 c4:9d:ed:ec:22:3e
2025-11-22T07:32:07.000000-05:00 rt-be88u dnsmasq-dhcp[17606]: DHCPACK(br0) 10.215.101.87 c4:9d:ed:ec:22:3e evolution
2025-11-22T07:32:15.000000-05:00 rt-be88u Scribe[-]: kill_logger[10270]: /usr/bin/logger optmsg=[/opt/var/log/messages]
2025-11-22T07:32:15.000000-05:00 rt-be88u Scribe[-]: kill_logger[10270]: /usr/bin/logger syslog_loc=[/jffs/syslog.log]
2025-11-22T07:32:15.000000-05:00 rt-be88u Scribe[-]: kill_logger[10270]: /usr/bin/logger script_conf=[/jffs/addons/scribe.d/config]

Good catch!
Can you try running the 'develop' branch 3.2.5 version to verify if those log entries are being suppressed?

/jffs/scripts/scribe develop

 

[scootertramp]

Good catch!
Can you try running the 'develop' branch 3.2.5 version to verify if those log entries are being suppressed?

/jffs/scripts/scribe develop

Running 3.2.5 develop not longer seeing the messages.

checking syslog-ng configuration ...

syslog-ng.conf version check ... in sync. (4.7)
syslog-ng.conf syntax check ... okay!

scribe installed version: v3.2.5 (develop)
scribe GitHub version: v3.2.5 (develop)
scribe is up to date!

 

[Martinski]

Running 3.2.5 develop not longer seeing the messages.

OK, looks good. Thanks for the verification. I'll issue a new release by tomorrow night, unless something comes up.

Side Note: I also updated three xt-8 nodes to Scribe 3.2.4 and do not see these messages.

BTW, I didn't see those repeated log entries while testing the 3.2.4 version on my RT-AX86U_PRO, but it looks like under certain circumstances some routers tend to be more "chatty" than others...

 

[scootertramp]

OK, looks good. Thanks for the verification. I'll issue a new release by tomorrow night, unless something comes up.


BTW, I didn't see those repeated log entries while testing the 3.2.4 version on my RT-AX86U_PRO, but it looks like under certain circumstances some routers tend to be more "chatty" than others...

I spoke too soon. I just when back an found those messages on all three xt-8's.
It just didn't happen as fast or as often as what I saw on the RT-BE88U.

 

[visortgw]

OK, looks good. Thanks for the verification. I'll issue a new release by tomorrow night, unless something comes up.


BTW, I didn't see those repeated log entries while testing the 3.2.4 version on my RT-AX86U_PRO, but it looks like under certain circumstances some routers tend to be more "chatty" than others...

I did not see them either...

 

[Martinski]

I spoke too soon. I just when back an found those messages on all three xt-8's.
It just didn't happen as fast or as often as what I saw on the RT-BE88U.

Yeah, the "chattiness" seems to be triggered by some events, more so in some routers, apparently.

 

[scootertramp]

Yeah, the "chattiness" seems to be triggered by some events, more so in some routers, apparently.

Odd, on the BE88U the messages where every two minutes apart whether something got logged between or not.

On the XT-8's I have only seen one occurrence since upgrading on each just after the fw check.

2025-11-22T10:10:46.000000-05:00 xt8-down rc_service[-]: cfg_client 31209:notify_rc stop_fw_check
2025-11-22T10:10:46.000000-05:00 xt8-down custom_script[-]: Running /jffs/scripts/service-event (args: stop fw_check)
2025-11-22T10:10:47.000000-05:00 xt8-down rc_service[-]: cfg_client 31209:notify_rc start_fw_check
2025-11-22T10:10:47.000000-05:00 xt8-down custom_script[-]: Running /jffs/scripts/service-event (args: start fw_check)
2025-11-22T10:10:48.000000-05:00 xt8-down Scribe[-]: kill_logger[13383]: /usr/bin/logger optmsg=[/opt/var/log/messages]
2025-11-22T10:10:48.000000-05:00 xt8-down Scribe[-]: kill_logger[13383]: /usr/bin/logger syslog_loc=[/tmp/syslog.log]
2025-11-22T10:10:48.000000-05:00 xt8-down Scribe[-]: kill_logger[13383]: /usr/bin/logger script_conf=[/jffs/addons/scribe.d/config]

 

[penguin22]

I see them as well as of this morning, which was a fun goose egg when working on finding out why dnsmasq restarted over 60K times overnight and has been a persistent issue causing my messages log to grow to several hundred MB and the router to go haywire. It would be very helpful to have the ability to clear specific logs or logrotate from the uiScribe GUI. I was hunting for this capability, which appears to only be without Scribe installed and had to go hunting through SSH to get it cleared for the router to be responsive again.

In my case, Scribe separating out the logs was so helpful in troubleshooting what appears to be unbound restarting dnsmasq frequently regardless of whether any updates and changes required it.

 

[scootertramp]

I see them as well as of this morning, which was a fun goose egg when working on finding out why dnsmasq restarted over 60K times overnight and has been a persistent issue causing my messages log to grow to several hundred MB and the router to go haywire. It would be very helpful to have the ability to clear specific logs or logrotate from the uiScribe GUI. I was hunting for this capability, which appears to only be without Scribe installed and had to go hunting through SSH to get it cleared for the router to be responsive again.

In my case, Scribe separating out the logs was so helpful in troubleshooting what appears to be unbound restarting dnsmasq frequently regardless of whether any updates and changes required it.

Syslog-ng can also rotate logs based on size.