Scribe Scribe v3.2.6 [2025-Dec-22] - Entware syslog-ng and logrotate installer for Asuswrt-Merlin

[Davidncali001]

I take it you're not using a usb drive?
With a small directory as /jffs I would definitely recommend using one.
Mystery how your syslog got so large in the first place.

yes i am and have been for many years. I am using a 32GB drive i believe and it has a 2gb swap on it.

 

[Ripshod]

I've just checked my jffs partition and there's just a symlink to the file elsewhere.
Which leads me to believe your true syslog file (on your usb) is unwriteable.

 

[Davidncali001]

I've just checked my jffs partition and there's just a symlink to the file elsewhere.
Which leads me to believe your true syslog file (on your usb) is unwriteable.

So you think it’s not writing to the usb drive and it’s been just writing to jffs? If that’s the case I’m not sure how to fix that, or maybe do I need a new usb drive?

 

[Ripshod]

Give it time, someone will likely post some ssh commands to check all partitions for RW permissions. I have noted them down on my work pc but that's at work lol
I suppose you could just try copying a file to your usb drive.

 

[elorimer]

Ah, got it. Thanks for the correction. I'm not aware at all of the history behind the development of the Scribe and uiScribe add-ons. The top header of the shell script does mention that code was borrowed from a few SNBForums contributors, but there are no names associated with the functions, so it's rather impossible to tell who originally wrote what and when; hence, my assumption that @cmkelley was who wrote that specific function.

This is where it started: https://www.snbforums.com/threads/configuring-syslog-ng-with-merlin-firmware.35095/
I'd forgotten that Tomsk helped work it out with kvic.

 

[Tarek Yag]

So you think it’s not writing to the usb drive and it’s been just writing to jffs? If that’s the case I’m not sure how to fix that, or maybe do I need a new usb drive?

I think the best troubleshooting method for your particular case is removing Scribe and re-installing it.
Best to do a reboot right after uninstalling it. This way you would get notified of any missing requirements while installing Scribe. Hence, taking proper actions in your setup.

someone will likely post some ssh commands to check all partitions for RW permissions.

Did you mean all folders on USB drive? I can help with this if he continues to have related issues.

 

[Davidncali001]

I think the best troubleshooting method for your particular case is removing Scribe and re-installing it.
Best to do a reboot right after uninstalling it. This way you would get notified of any missing requirements while installing Scribe. Hence, taking proper actions in your setup.

Did you mean all folders on USB drive? I can help with this if he continues to have related issues.

This is where it started: https://www.snbforums.com/threads/configuring-syslog-ng-with-merlin-firmware.35095/
I'd forgotten that Tomsk helped work it out with kvic.

I think the best troubleshooting method for your particular case is removing Scribe and re-installing it.

Hello, yes I did uninstall Scribe and then rebooted the router and then reinstalled Scribe and the logs are still showing up in the /jffs/syslog.log directory for some reason. I'm willing to try anything to get it in the correct directory I just don't know how or where to go about doing that. Any help would be appreciated!

 

[visortgw]

Hello, yes I did uninstall Scribe and then rebooted the router and then reinstalled Scribe and the logs are still showing up in the /jffs/syslog.log directory for some reason. I'm willing to try anything to get it in the correct directory I just don't know how or where to go about doing that. Any help would be appreciated!

That's the default location for syslog.log on the newer routers — it's in the correct location (i.e., /jffs) already, since there is a symbolic link to /opt/var/log/messages (on the USB drive) after installing scribe. The filtered logs (after scribe processing) reside in /opt/var/log, which is the USB drive.

 

[Ripshod]

Hello, yes I did uninstall Scribe and then rebooted the router and then reinstalled Scribe and the logs are still showing up in the /jffs/syslog.log directory for some reason. I'm willing to try anything to get it in the correct directory I just don't know how or where to go about doing that. Any help would be appreciated!

@Tarek Yag i think the time may have come for a few little scripts
syslog-ng should be following that symlink to write logs to /opt/var/log by default, so something is screwy here. I still suspect the usb drive.

 

[visortgw]

Hello, yes I did uninstall Scribe and then rebooted the router and then reinstalled Scribe and the logs are still showing up in the /jffs/syslog.log directory for some reason. I'm willing to try anything to get it in the correct directory I just don't know how or where to go about doing that. Any help would be appreciated!

What does the Show scribe status command (i.e., s.) within scribe show for syslog.log default location?

 Please select an option: s

      checking syslog-ng daemon ... alive.
    syslog.log default location ... /jffs/syslog.log
  ... & agrees with config file ... okay!

 checking system for necessary scribe hooks ...

          checking S01syslog-ng ... present.
         checking service-event ... present.
            checking post-mount ... present.
               checking unmount ... present.
    checking logrotate cron job ... present.
       checking directory links ... present.

 checking syslog-ng configuration ...

   syslog-ng.conf version check ... in sync. (4.7)
    syslog-ng.conf syntax check ... okay!

          scribe installed version: v3.2.5 (master)
             scribe GitHub version: v3.2.5 (master)
                    scribe is up to date!

 Press <Enter> key to continue:

Does ls -al /jffs/syslog.log show the symbolic link?

# ls -al /jffs/syslog.log
lrwxrwxrwx    1 TheS1R   root            21 Nov 29 09:32 /jffs/syslog.log -> /opt/var/log/messages

 

[scootertramp]

What does the Show scribe status command (i.e., s.) within scribe show for syslog.log default location?

 Please select an option: s

      checking syslog-ng daemon ... alive.
    syslog.log default location ... /jffs/syslog.log
  ... & agrees with config file ... okay!

 checking system for necessary scribe hooks ...

          checking S01syslog-ng ... present.
         checking service-event ... present.
            checking post-mount ... present.
               checking unmount ... present.
    checking logrotate cron job ... present.
       checking directory links ... present.

 checking syslog-ng configuration ...

   syslog-ng.conf version check ... in sync. (4.7)
    syslog-ng.conf syntax check ... okay!

          scribe installed version: v3.2.5 (master)
             scribe GitHub version: v3.2.5 (master)
                    scribe is up to date!

 Press <Enter> key to continue:

Does ls -al /jffs/syslog.log show the symbolic link?

# ls -al /jffs/syslog.log
lrwxrwxrwx    1 TheS1R   root            21 Nov 29 09:32 /jffs/syslog.log -> /opt/var/log/messages

Might be while checking if the usb drive is mounted and that /tmp/opt points to the usb drive.

# df -h /dev/sda1
Filesystem Size Used Available Use% Mounted on
/dev/sda1 29.1G 1.1G 26.5G 4% /tmp/mnt/rt-be88u

# ls -al /tmp/opt
lrwxrwxrwx 1 agagne root 25 Nov 26 06:02 /tmp/opt -> /tmp/mnt/rt-be88u/entware

Exchange router name for whatever yours is.

 

[Ripshod]

Might be while checking if the usb drive is mounted

And writeable?

 

[Tarek Yag]

Hello, yes I did uninstall Scribe and then rebooted the router and then reinstalled Scribe

Did you encounter any errors or warnings in the whole process?

still showing up in the /jffs/syslog.log directory for some reason.

You'll always find this path in your router, as this should be a symbolic link, such as my fellows' posts before mine just explained to you.
I'll keep watching your case until you get it solved, don't hesitate to ask, this community is very helpful.

 

[scootertramp]

And writeable?

Did you encounter any errors or warnings in the whole process?

You'll always find this path in your router, as this should be a symbolic link, such as my fellows' posts before mine just explained to you.
I'll keep watching your case until you get it solved, don't hesitate to ask, this community is very helpful.

That may not be the case in all systems. Not sure when it changed but on my rt-be88u and all three xt-8's
it is an empty directory.

scribe version: 3.2.5

agagne@rt-be88u:/tmp/home/root# ls -la /jffs/syslog*
/jffs/syslog.log:
drwxrwxrwx 2 agagne root 160 Nov 22 09:27 .
drwxr-xr-x 18 agagne root 2880 Nov 29 14:49 ..

/jffs/syslog.log-1:
drwxrwxrwx 2 agagne root 160 Nov 22 09:27 .
drwxr-xr-x 18 agagne root 2880 Nov 29 14:49 .

agagne@xt8-up:/tmp/home/root# ls -la /jffs/syslog.*
/jffs/syslog.log:
drwxrwxrwx 2 agagne root 0 Nov 19 16:00 .
drwxr-xr-x 16 agagne root 0 Nov 29 13:23 ..

/jffs/syslog.log-1:
drwxrwxrwx 2 agagne root 0 Nov 19 16:00 .
drwxr-xr-x 16 agagne root 0 Nov 29 13:23 ..

 

[visortgw]

That may not be the case in all systems. Not sure when it changed but on my rt-be88u and all three xt-8's
it is an empty directory.

scribe version: 3.2.5

agagne@rt-be88u:/tmp/home/root# ls -la /jffs/syslog*
/jffs/syslog.log:
drwxrwxrwx 2 agagne root 160 Nov 22 09:27 .
drwxr-xr-x 18 agagne root 2880 Nov 29 14:49 ..

/jffs/syslog.log-1:
drwxrwxrwx 2 agagne root 160 Nov 22 09:27 .
drwxr-xr-x 18 agagne root 2880 Nov 29 14:49 .

agagne@xt8-up:/tmp/home/root# ls -la /jffs/syslog.*
/jffs/syslog.log:
drwxrwxrwx 2 agagne root 0 Nov 19 16:00 .
drwxr-xr-x 16 agagne root 0 Nov 29 13:23 ..

/jffs/syslog.log-1:
drwxrwxrwx 2 agagne root 0 Nov 19 16:00 .
drwxr-xr-x 16 agagne root 0 Nov 29 13:23 ..

That may not be the case in all systems. Not sure when it changed but on my rt-be88u and all three xt-8's
it is an empty directory.

scribe version: 3.2.5

agagne@rt-be88u:/tmp/home/root# ls -la /jffs/syslog*
/jffs/syslog.log:
drwxrwxrwx 2 agagne root 160 Nov 22 09:27 .
drwxr-xr-x 18 agagne root 2880 Nov 29 14:49 ..

/jffs/syslog.log-1:
drwxrwxrwx 2 agagne root 160 Nov 22 09:27 .
drwxr-xr-x 18 agagne root 2880 Nov 29 14:49 .

agagne@xt8-up:/tmp/home/root# ls -la /jffs/syslog.*
/jffs/syslog.log:
drwxrwxrwx 2 agagne root 0 Nov 19 16:00 .
drwxr-xr-x 16 agagne root 0 Nov 29 13:23 ..

/jffs/syslog.log-1:
drwxrwxrwx 2 agagne root 0 Nov 19 16:00 .
drwxr-xr-x 16 agagne root 0 Nov 29 13:23 ..

What does your Show scribe status command show?

 

[scootertramp]

What does your Show scribe status command show?

Please select an option: s

checking syslog-ng daemon ... alive.
syslog.log default location ... /tmp/syslog.log
... & agrees with config file ... okay!

On both rt-be88u and xt-8's

 

[visortgw]

Please select an option: s

checking syslog-ng daemon ... alive.
syslog.log default location ... /tmp/syslog.log
... & agrees with config file ... okay!

On both rt-be88u and xt-8's

Weird that symbolic links don't show. Do you have data in /opt/var/log/messages?

 

[Ripshod]

Line 39, /opt/etc/syslog-ng.conf

destination messages { file("/opt/var/log/messages"); };

Stating the obvious, syslog-ng doesn't seem to use the symlink
I'm not saying there isn't an error, just realising for myself that syslog-ng is probably not causing this issue.

 

[Tarek Yag]

Weird that symbolic links don't show. Do you have data in /opt/var/log/messages?

Hmmm, that's super interesting. Mine are not showing as symbolic links too!!

# ls -al /jffs/syslog*
/jffs/syslog.log:
drwxrwxrwx    2 atr      root             0 Jan  1  2024 .
drwxr-xr-x   17 atr      root             0 Nov 29 05:10 ..

/jffs/syslog.log-1:
drwxrwxrwx    2 atr      root             0 Jan  1  2024 .
drwxr-xr-x   17 atr      root             0 Nov 29 05:10 ..

 Please select an option: s

      checking syslog-ng daemon ... alive.
    syslog.log default location ... /tmp/syslog.log
  ... & agrees with config file ... okay!

And my setup has always been working perfectly fine, and I have data in /opt/var/log/messages indeed, as always

 

[scootertramp]

Weird that symbolic links don't show. Do you have data in /opt/var/log/messages?

Yea, everything on both router models are working as expected.
This is where it gets a little weird.

rt-be88u:
agagne@rt-be88u:/tmp/home/root# ls -al /tmp/syslog.log
lrwxrwxrwx 1 agagne root 16 Dec 31 2023 /tmp/syslog.log -> /jffs/syslog.log

xt-8:
agagne@xt8-up:/tmp/home/root# ls -al /tmp/syslog.log
lrwxrwxrwx 1 agagne root 21 Nov 19 16:00 /tmp/syslog.log -> /opt/var/log/messages

Not sure how the rt-be88u is working but it is. I forward all messages to a syslog server.
With the rt-be88u being the main router it would be hard to miss message level from chatty box.