Scribe Scribe v3.2.5 [2025-Nov-23] - Entware syslog-ng and logrotate installer for Asuswrt-Merlin

[bibikalka]

OK, again the log has cleared upon reboot. Running the latest scribe:

 5  open     scribe                     3.2.4

I cleaned up the log a bit to remove lots of chatter with MAC addresses, and replaced mine:

cat messages | grep  -v DHCP[RADO] messages  |grep -v DROP |grep -v 'wlceventd_proc_event' | grep -v 'ovpn' |grep -v 'openvpn'

Not sure the clean log helps, but here it is attached.

Here is the relevant section of syslog-ng.log :

Nov 23 03:00:02 RT-AC86U-9988 syslog-ng[3368522]: Configuration reload finished;
Nov 23 04:00:02 RT-AC86U-9988 syslog-ng[3368522]: Configuration reload request received, reloading configuration;
Nov 23 04:00:02 RT-AC86U-9988 syslog-ng[3368522]: Configuration reload finished;
Nov 23 04:05:15 RT-AC86U-9988 syslog-ng[3368522]: syslog-ng shutting down; version='4.7.1'
Nov 23 04:06:47 RT-AC86U-9988 syslog-ng[2724]: syslog-ng starting up; version='4.7.1'
Nov 23 04:24:27 RT-AC86U-9988 syslog-ng[18664]: syslog-ng shutting down; version='4.7.1'
Nov 23 04:24:31 RT-AC86U-9988 syslog-ng[62424]: syslog-ng starting up; version='4.7.1'
Nov 23 04:24:33 RT-AC86U-9988 syslog-ng[62424]: Configuration reload request received, reloading configuration;
Nov 23 04:24:33 RT-AC86U-9988 syslog-ng[62424]: Configuration reload finished;
Nov 23 05:00:02 RT-AC86U-9988 syslog-ng[62424]: Configuration reload request received, reloading configuration;
Nov 23 05:00:02 RT-AC86U-9988 syslog-ng[62424]: Configuration reload finished;
Nov 23 06:00:02 RT-AC86U-9988 syslog-ng[62424]: Configuration reload request received, reloading configuration;
Nov 23 06:00:02 RT-AC86U-9988 syslog-ng[62424]: Configuration reload finished;

 

[Ripshod]

What is "Scribe:kill_logger"?
Since between 10 and 11am yesterday and midnight last night my log was filled with those messages, to the point my "messages" file was bloated to over 1MB, at which point logrotate failed, my router ceased logging, disconnected all WiFi and refused new connections over LAN.

*edit* TL;DR I see this has been addressed

 

[Martinski]

Release Notes for Scribe v3.2.5 production version now available
[2025-Nov-23]

1) IMPROVED: Suppressed some of the syslog entries for the 'kill_logger' function calls.

[Thanks to @scootertramp for reporting the repeated syslog entries showing up in some "chatty" routers]​

The fork from @cmkelley's Scribe add-on is now hosted on the AMTM-OSR GitHub repo:

GitHub - AMTM-OSR/scribe: Entware syslog-ng and logrotate installer for Asuswrt-Merlin

Entware syslog-ng and logrotate installer for Asuswrt-Merlin - AMTM-OSR/scribe

github.com

 

[Martinski]

What is "Scribe:kill_logger"?
Since between 10 and 11am yesterday and midnight last night my log was filled with those messages, to the point my "messages" file was bloated to over 1MB, at which point logrotate failed, my router ceased logging, disconnected all WiFi and refused new connections over LAN.

It's a function that @cmkelley wrote to try to reset the syslog file paths and create the desired symbolic links to the new log files so that Scribe could work as expected.

Here's the comment from the script:

# load kill_logger() function to reset system path links/hacks

 

[Ripshod]

But what causes it to suddenly fire off so suddenly and so frequently? Have you suppressed the function or just the messages?

 

[Martinski]

OK, again the log has cleared upon reboot. Running the latest scribe:

 5  open     scribe                     3.2.4

I cleaned up the log a bit to remove lots of chatter with MAC addresses, and replaced mine:

cat messages | grep  -v DHCP[RADO] messages  |grep -v DROP |grep -v 'wlceventd_proc_event' | grep -v 'ovpn' |grep -v 'openvpn'

Not sure the clean log helps, but here it is attached.

Here is the relevant section of syslog-ng.log :

Nov 23 03:00:02 RT-AC86U-9988 syslog-ng[3368522]: Configuration reload finished;
Nov 23 04:00:02 RT-AC86U-9988 syslog-ng[3368522]: Configuration reload request received, reloading configuration;
Nov 23 04:00:02 RT-AC86U-9988 syslog-ng[3368522]: Configuration reload finished;
Nov 23 04:05:15 RT-AC86U-9988 syslog-ng[3368522]: syslog-ng shutting down; version='4.7.1'
Nov 23 04:06:47 RT-AC86U-9988 syslog-ng[2724]: syslog-ng starting up; version='4.7.1'
Nov 23 04:24:27 RT-AC86U-9988 syslog-ng[18664]: syslog-ng shutting down; version='4.7.1'
Nov 23 04:24:31 RT-AC86U-9988 syslog-ng[62424]: syslog-ng starting up; version='4.7.1'
Nov 23 04:24:33 RT-AC86U-9988 syslog-ng[62424]: Configuration reload request received, reloading configuration;
Nov 23 04:24:33 RT-AC86U-9988 syslog-ng[62424]: Configuration reload finished;
Nov 23 05:00:02 RT-AC86U-9988 syslog-ng[62424]: Configuration reload request received, reloading configuration;
Nov 23 05:00:02 RT-AC86U-9988 syslog-ng[62424]: Configuration reload finished;
Nov 23 06:00:02 RT-AC86U-9988 syslog-ng[62424]: Configuration reload request received, reloading configuration;
Nov 23 06:00:02 RT-AC86U-9988 syslog-ng[62424]: Configuration reload finished;

I reviewed your log and didn't see anything that stood out as the source of a possible issue. Then again, keep in mind that I actually don't use Scribe in my own routers on a continuous basis, so my experience with it is limited to a few temporary runs (for a day or two at a time) for development and testing purposes.

What I'd suggest now is to update to the latest production release v3.2.5, and the next time you reboot, capture the syslog covering the entire sequence of events during the bootup, and also run the following command without making any changes to Scribe:
<CODE>
/jffs/scripts/scribe debug
<CODE>
Then post the 'scribe_debug.log' file that gets generated.

Or could it be impacted by 'uiScribe' update? I did that update at the same time as scribe originally.

Note that uiScribe only reads the log files for displaying or downloading purposes; there's no other interaction with the log files.

 

[Martinski]

But what causes it to suddenly fire off so suddenly and so frequently?

Good question. I don't know why in some routers, under some circumstances, the 'service-event' is called very often and repeatedly, one after the other, within a few minutes, which triggers the function calls.

Have you suppressed the function or just the messages?

The log entries were suppressed when triggered by a 'service-event' call.

 

[bibikalka]

Then post the 'scribe_debug.log' file that gets generated.

Debug log today - without a reboot yet.

 

[elorimer]

It's a function that @cmkelley wrote to try to reset the syslog file paths and create the desired symbolic links to the new log files so that Scribe could work as expected.

Originally, kvic wrote it. It used to be something simple that killed syslogd and klogd, started syslog-ng, and stopped writing to the /tmp logs and created the symbolic links. Hence the name. Then there was a bit added by cmkelley to detect whether the log was in /tmp or /jffs. Now there is a whole lot that could be set and forget for a particular router, or at least moved to scribe and not S01.