Scribe Scribe v3.2.5 [2025-Nov-23] - Entware syslog-ng and logrotate installer for Asuswrt-Merlin

[Ripshod]

Gilly@ripshod:/tmp/home/root# ls -al /jffs/syslog.log
lrwxrwxrwx    1 Gilly    root            21 Nov 28 16:17 /jffs/syslog.log -> /opt/var/log/messages

 

[visortgw]

Please select an option: s

checking syslog-ng daemon ... alive.
syslog.log default location ... /tmp/syslog.log
... & agrees with config file ... okay!

On both rt-be88u and xt-8's

On second thought, I would perform Re-detect syslog.log location within scribe Utilities to see if it cleaned things up and created symbolic links. Empty directories definitely do not make sense...

 

[scootertramp]

On second thought, I would perform Re-detect syslog.log location within scribe Utilities to see if it cleaned things up and created symbolic links. Empty directories definitely do not make sense...

Good catch.

agagne@rt-be88u:/tmp/home/root# ls -al /jffs/syslog.log
lrwxrwxrwx 1 agagne root 21 Nov 29 15:37 /jffs/syslog.log -> /opt/var/log/messages

Now it looks normal.

 

[Ripshod]

Good catch.

agagne@rt-be88u:/tmp/home/root# ls -al /jffs/syslog.log
lrwxrwxrwx 1 agagne root 21 Nov 29 15:37 /jffs/syslog.log -> /opt/var/log/messages

Now it looks normal.

Now try a reboot, see if it sticks.

 

[scootertramp]

Good catch.

agagne@rt-be88u:/tmp/home/root# ls -al /jffs/syslog.log
lrwxrwxrwx 1 agagne root 21 Nov 29 15:37 /jffs/syslog.log -> /opt/var/log/messages

Now it looks normal.

Doesn't change anything on my xt-8's. But they have a vaild symlink in /tmp/syslog.log

agagne@xt8-up:/tmp/home/root# ls -la /jffs/syslog.log
drwxrwxrwx 2 agagne root 0 Nov 29 15:40 .
drwxr-xr-x 16 agagne root 0 Nov 29 15:40 ..
agagne@xt8-up:/tmp/home/root# ls -la /tmp/syslog.log
lrwxrwxrwx 1 agagne root 21 Nov 29 15:40 /tmp/syslog.log -> /opt/var/log/messages

 

[scootertramp]

Now try a reboot, see if it sticks.

Still there after reboot.

 

[Tarek Yag]

The following output is ordered by execution time...

Please select an option: rd

 Detecting default syslog location...
 Briefly shutting down syslog-ng
Done.
 Starting syslog-ng...              done.

Please select an option: s

      checking syslog-ng daemon ... alive.
    syslog.log default location ... /tmp/syslog.log
  ... & agrees with config file ... okay!

# ls -al /jffs/syslog*
/jffs/syslog.log:
drwxrwxrwx    2 atr      root             0 Nov 29 23:38 .
drwxr-xr-x   17 atr      root             0 Nov 29 23:38 ..

/jffs/syslog.log-1:
drwxrwxrwx    2 atr      root             0 Nov 29 23:38 .
drwxr-xr-x   17 atr      root             0 Nov 29 23:38 ..

# ls -al /tmp/syslog*
lrwxrwxrwx    1 atr      root            21 Nov 29 23:48 /tmp/syslog.log -> /opt/var/log/messages
-rw-rw-rw-    1 atr      root            24 Nov 29 23:48 /tmp/syslog.log-1

In the end, I just did a router reboot, and nothing above changed.

 

[scootertramp]

Now I'm left to ponder where it all went south.

1) upgrade scribe to 3.2.4 on all routers
2) switch the rt-be88u to scribe 3.2.5 Beta due to killl log messages
3) upgrade scribe to 3.2.5 on all routers.
4) The big one. FW upgrade on rt-be88u to 3006.102.6 from 3006.102.6 Beta.

Not gonna lose any sleep over it. Everything worked throughout.
Time for something cold.

 

[Ripshod]

4) The big one. FW upgrade on rt-be88u to 3006.102.6 from 3006.102.6 Beta.

Same router, same upgrade route - no problems. Never ran the scribe beta.
I'll join ya

 

[visortgw]

The following output is ordered by execution time...

Please select an option: rd

 Detecting default syslog location...
 Briefly shutting down syslog-ng
Done.
 Starting syslog-ng...              done.

Please select an option: s

      checking syslog-ng daemon ... alive.
    syslog.log default location ... /tmp/syslog.log
  ... & agrees with config file ... okay!

# ls -al /jffs/syslog*
/jffs/syslog.log:
drwxrwxrwx    2 atr      root             0 Nov 29 23:38 .
drwxr-xr-x   17 atr      root             0 Nov 29 23:38 ..

/jffs/syslog.log-1:
drwxrwxrwx    2 atr      root             0 Nov 29 23:38 .
drwxr-xr-x   17 atr      root             0 Nov 29 23:38 ..

# ls -al /tmp/syslog*
lrwxrwxrwx    1 atr      root            21 Nov 29 23:48 /tmp/syslog.log -> /opt/var/log/messages
-rw-rw-rw-    1 atr      root            24 Nov 29 23:48 /tmp/syslog.log-1

In the end, I just did a router reboot, and nothing above changed.

Older routers did not use /jffs/syslog.log, but rather they used /tmp/syslog.log — I'm not sure at what point Asus switched to /jffs.

 

[Tarek Yag]

Older routers did not use /jffs/syslog.log, but rather they used /tmp/syslog.log— I'm not sure at what point Asus switched to /jffs.

Thank you for confirming! By sharing my router output, I just wanted to make sure that things are fine in my setup, and help others in future searches for comparison between setups.
I'm already aware that Asus made this switch some time ago, but I wasn't sure to which age my router belongs.

 

[Davidncali001]

What does the Show scribe status command (i.e., s.) within scribe show for syslog.log default location?

 Please select an option: s

      checking syslog-ng daemon ... alive.
    syslog.log default location ... /jffs/syslog.log
  ... & agrees with config file ... okay!

 checking system for necessary scribe hooks ...

          checking S01syslog-ng ... present.
         checking service-event ... present.
            checking post-mount ... present.
               checking unmount ... present.
    checking logrotate cron job ... present.
       checking directory links ... present.

 checking syslog-ng configuration ...

   syslog-ng.conf version check ... in sync. (4.7)
    syslog-ng.conf syntax check ... okay!

          scribe installed version: v3.2.5 (master)
             scribe GitHub version: v3.2.5 (master)
                    scribe is up to date!

 Press <Enter> key to continue:

Does ls -al /jffs/syslog.log show the symbolic link?

# ls -al /jffs/syslog.log
lrwxrwxrwx    1 TheS1R   root            21 Nov 29 09:32 /jffs/syslog.log -> /opt/var/log/messages

I ran some commands you asked for:

 

[Martinski]

I ran some commands you asked for:

View attachment 69245View attachment 69246View attachment 69247View attachment 69248View attachment 69249

The screenshots and output shown in your latest post look correct, and they indicate that your Scribe setup is currently configured as expected. If your JFFS partition continues to get filled up again, I suspect it might be caused by something else, but perhaps it leads to a corruption in the Scribe functionality.

I have a custom shell script that I've used before as a diagnostic tool to monitor cases when either the TMPFS or the JFFS file system was being filled up slowly with large files over a period of a few weeks. IIRC, the last time was about 2 years ago, where the Traffic Monitor (or Traffic Analyzer??) was generating a very large database file (a little over 40MB). The log file generated by the diagnostic script and stored in the USB-attached drive showed the database file slowly increasing and filling the JFFS partition during the previous 3 weeks.

In your particular case, I don't really know what's causing the problem, but you could set up the diagnostic script to run as a cron job at a fixed interval (e.g. every 20 mins or every 4 hours), depending on how fast the JFFS is getting filled up and, hopefully, the log file will capture some rogue file(s) getting larger over time.

You can use the following commands to download the custom script from my personal GitHub repo:

curl  -LSs --retry 3 --retry-delay 5 --retry-connrefused \
https://raw.githubusercontent.com/Martinski4GitHub/CustomMiscUtils/master/Diags/LogMemoryStats.sh \
-o /jffs/scripts/LogMemoryStats.sh && chmod a+x /jffs/scripts/LogMemoryStats.sh

Once downloaded into the router, type the following command:

/jffs/scripts/LogMemoryStats.sh -help

The output will provide some useful CLI syntax to set up the cron job and other parameters to configure the diagnostic script for your own specific needs. Try to run the script by itself first to see the kind of output that gets generated, and if you're willing to let it run as a cron job, execute the call to set it up with your preferred time interval. If you want the cron job to persist across reboots, copy & paste the given command at the end of your '/jffs/scripts/post-mount' hook script.

Example call:

/jffs/scripts/LogMemoryStats.sh -setcronjob 1hour

HTH.

 

[Martinski]

Over the past few months, I've seen several posts from uiScribe users mentioning, suggesting, or asking about the ability to rotate or "clear" the log files on demand. Given that some of the log files appear to grow very fast and much larger than the size directive should allow (I don't know why), I started working on a solution.

Below is a screenshot from last night of what I have implemented so far:

The above screenshot was taken some time after clicking on the "Clear All" button.

The idea is to allow users to either rotate or clear each log individually or all at once. The log file sizes are also displayed so that users can check when a log file is growing too large. I'll have more information later about the new features, so this is just a quick FYI for now.

 

[elorimer]

This is a great idea. Can I suggest, while you are into that, that you have a go at changing the message for a zero-size log and a bigly size log? Now, if the log is too big, uiScribe displays a message that the log file cannot be found; it displays the same message if a log file exists but is of zero length (i.e. right after rotating). Both are wrong and send you in the wrong direction for troubleshooting. This solution addresses that with the size display, so maybe it only needs to suppress the incorrect message when the file exists.

 

[elorimer]

Not sure I'm following all this, but scribe implements an old Merlin trick of changing the firmware default log files to directories. The firmware writes (wrote?) the logs to /tmp and copied it to /jffs, and this prevents unnecessary wear on the /jffs location. The trick dates back to the very first versions.

Syslog on jffs ??

Hello everyone, I just found out that i have syslog.log and syslog.log-1 files on my /jffs partition. Is this normal? If not, how can I stop it? I have 0 knowledge of where is the syslog config files and how to change it. Thanks for the help!

www.snbforums.com

QOS data storage

Hello, I’ve just recently upgraded my rt-ac66u to a ac5300. Love all the new feature. But been wondering with all the data Qos like web history and app analysis take up on the router does it kill the nvram over time or does it goes into the ram? Thanks.

www.snbforums.com