Scribe Scribe v3.2.6 [2025-Dec-22] - Entware syslog-ng and logrotate installer for Asuswrt-Merlin

[Martinski]

On Saturday evening, I started to take a much closer look at the 2 major junctions when a router running Scribe transitions from using the built-in system loggers (klogd and syslogd) to running syslog-ng (when Entware services are started after the USB-attached drive is mounted), and vice versa (when Entware services are stopped after the USB-attached drive is unmounted).

After analyzing the sequence of events around the execution flow of the '/jffs/scripts/post-mount' and '/jffs/scripts/unmount' scripts, and also running some debugging code, I found 2 significant problems:

1) When the call to Scribe found in the '/jffs/scripts/unmount' script is made *after* the Entware services are stopped, it fails to properly reset and put back the system log files so the built-in system loggers can then proceed to update them. This, in turn, is causing hundreds of log messages to be "lost" during a reboot sequence.

2) Upon a system reboot, when Entware services are started, syslog-ng was shutting down the built-in system loggers too early and with a minimum 2-second delay (and perhaps more in some cases), causing hundreds (and possibly close to a thousand) of reboot log messages to be "lost" due to the "deluge" of log entries flooding the system logs within the first ~2 to ~3 minutes of the bootup process (the time can vary depending on the number of built-in services and Entware services being started, and other system initialization activities).

So in order to address the above 2 problems, I've modified the code. For the 1st issue, when unmounting the USB drive, I'm making sure that the system log files are put back after syslog-ng is stopped, and before the built-in loggers (klogd and syslogd) are restarted. Also, I've added code to save a backup of the syslog-ng messages log file, for restoration purposes.

For the 2nd problem, I'm creating a background script to handle the delay of starting syslog-ng service until the reboot sequence has completed, and system activity has reached a more "normal" state, when the deluge of reboot log messages has also subsided. This usually happens within the first ~3 minutes after a reboot, and only then will the background task start syslog-ng in a more "stable" context/environment.

I plan to have a new BETA version of Scribe by Sunday evening once I've completed, tested, and validated (as much as I can) all the recent changes.

Just FYI.

 

[Twiglets]

Typical ... I actually do 'something' with scribe and you 'change' it !!! <jk>

Thanks for the detective work to make things better ... much appreciated.

Look forward to the 'improved' version that is thankfully without 'AI' [Cough Spit], long may it continue !!!

[Must be one of the few things that don't include the 'AI' [Cough Spit] word ... expect 'Soap powder/pods' to have 'AI' included soon !!!]

 

[elorimer]

For the 2nd problem, I'm creating a background script to handle the delay of starting syslog-ng service until the reboot sequence has completed, and system activity has reached a more "normal" state, when the deluge of reboot log messages has also subsided. This usually happens within the first ~3 minutes after a reboot, and only then will the background task start syslog-ng in a more "stable" context/environment.

Awesome work. This is likely a more robust solution than my idea of simply making syslog-ng start with S99. There's no reason syslog-ng has to be first out of the block.

 

[aru]

How to add another logs to the uiscribe?

I only need to create configuration files containing the keywords I want to filter in the /opt/etc/logrotate.d and /opt/etc/syslog-ng.d directories. The Scribe plugin will then automatically load them into the Web UI for easier viewing and management. If I want to disable the filtering later, I can simply delete the custom configuration files.

I use acsd as an example by copying the existing wlceventd configuration file and modifying its contents to filter acsd-related messages.

/opt/etc/syslog-ng.d/acsd

destination d_acsd {
    file("/opt/var/log/acsd.log");
};

filter f_acsd {
    program("acsd") or message("acsd") or program("cfg_server") or
    message("cfg_server") or
    message("DFS")
;
};

log {
    source(src);
    filter(f_acsd);
    destination(d_acsd);
    flags(final);
};

/opt/etc/logrotate.d/acsd

/opt/var/log/acsd.log {
    rotate 4
    postrotate
        /usr/bin/killall -HUP syslog-ng
    endscript
}

After creating the acsd configuration file, go to the Scribe menu in amtm and run rl, lr, and rs to reload the configuration and restart syslog-ng. Once completed, log in to the router and you will see an additional set of acsd-related information.

In addition, I referred to another article to forward all information from the node hosts back to the main router, making it easier to view everything in one place and enabling centralized aggregation of node host logs.

Scribe - Feature to support AiMesh node(s) log?

I went in the other direction. Got scribe on router and both nodes. Have nodes forwarding to router (A00remote). Syslog-ng filters putting all of it where it suppossed to go. Debating creating my own filters based on the hostname of the AImiesh nodes (logrotate as well), the part two. This...

www.snbforums.com

I hope the above explanation is helpful to you.

 

[Martinski]

Release Notes for Scribe v3.2.7 BETA Development Version
[BETA v3.2.7_26011122] [2026-Jan-12]

1) FIXED: When the call to Scribe found in the '/jffs/scripts/unmount' script was made *after* the Entware services had been stopped, it failed to properly reset and put back the system log files so the built-in system loggers could then proceed to update them. This, in turn, was causing hundreds of log messages to be "lost" during a reboot sequence.

2) FIXED: Upon a system reboot, when Entware services are started, syslog-ng was shutting down the built-in system loggers too early and with a minimum 2-second delay (and perhaps more in some cases), causing hundreds (and possibly close to a thousand) of reboot log messages to be "lost" due to the "deluge" of log entries flooding the system logs within the first ~2 to ~3 minutes of the bootup process. Now, the start of syslog-ng is delayed for 150 seconds after "rc.unslung" is called to start all Entware services.

3) IMPROVED: Added 2-hour, 3-hour, and 4-hour intervals for the logrotate cron job options.

4) IMPROVED: Decreased the log message size to 2048 (from original 16384) in the syslog-ng configuration file.

5) IMPROVED: Increased the log FIFO queue for the number of messages to 1024 (2048 if total RAM > 512MB) in the syslog-ng configuration file.

6) IMPROVED: Improvements in the display of CLI menu options.

7) Miscellaneous code improvements.

To update from the currently installed production version to the latest 3.2.7 BETA development version, run the following commands on an SSH terminal session:

/jffs/scripts/scribe develop
/jffs/scripts/scribe forceupdate

Sample screenshots:

Below is a sample screenshot showing the message generated when the Scribe CLI menu is launched while waiting for the syslog-ng service to be started following a reboot. The wait may be up to 150 seconds if you log into an SSH terminal immediately after the router has rebooted, but before syslog-ng is started by the background process. Simply wait for the number of seconds shown in the message.

 

[Martinski]

...
/opt/etc/logrotate.d/acsd

/opt/var/log/acsd.log {
    rotate 4
    postrotate
        /usr/bin/killall -HUP syslog-ng
    endscript
}

Just an observation: starting with Scribe v3.2.6 production release, it's no longer necessary to create a logrotate configuration file for each filtered logfile unless you want to override the global defaults set in the "/opt/etc/logrotate.d/A01global" file. And if you do create a configuration file, it's highly recommended to omit the "postrotate/endscript" option since that's already set by the global defaults.

 

[aru]

Just an observation: starting with Scribe v3.2.6 production release, it's no longer necessary to create a logrotate configuration file for each filtered logfile unless you want to override the global defaults set in the "/opt/etc/logrotate.d/A01global" file. And if you do create a configuration file, it's highly recommended to omit the "postrotate/endscript" option since that's already set by the global defaults.

It seems that starting from Scribe v3.2.6, /opt/etc/logrotate.d/A01global uses a centralized management approach. Unless there is a need to override the default behavior, there is no need to create additional logrotate configuration files. Thanks to the developer for the clear explanation and guidance.

 

[elorimer]

the global defaults set in the "/opt/etc/logrotate.d/A01global" file

Along these lines, we can get rid of A00global.

Giving it a go now.

Also, when Entware updates syslog-ng to 4.10, we'll be able to get rid of logrotate altogether, including the sighup

 

[Twiglets]

Installed and up and running !!!

WWIII *has* NOT Started !!!

All is Well !!!