Script to remove dcd crashes from system log

[Butterfly Bones]

are dcd crashes only an issue for people that use the trend micro features/agreement? I've not had this problem pop up yet

Yes, I only had AI Protection on no QoS or Traffic Analyzer and the crashes went way. The only hits I ever had on AI Protection were from attempts on a VPN provider server that I got a "deal" years ago from an android forum. I have few users on my network and all are adults who understand not to visit shady sights, so I may turn it off permanently. Skynet does an excellent job of keeping the rogue attempts out.

 

[gattaca]

Yes, I only had AI Protection on no QoS or Traffic Analyzer and the crashes went way. The only hits I ever had on AI Protection were from attempts on a VPN provider server that I got a "deal" years ago from an android forum. I have few users on my network and all are adults who understand not to visit shady sights, so I may turn it off permanently. Skynet does an excellent job of keeping the rogue attempts out.

I see these and I have none of the TrendMicro stuff on.

Thanks for the pointers, I ended up doing just adding the sed to the crond per the earlier mention. I just run it at 11 and 33 mins every hour:

1) cru a xxx-remove-dcd-crash "11,33 * * * * /bin/sed -i '/kernel: dcd/,/kernel: x1 /d' /tmp/syslog.log "

2) and I just added that line to the /jffs/scripts/post-mount per above..
#!/bin/sh
swapon /tmp/mnt/3622-ASUS-AC86U/myswap.swp # Swap file created by amtm
. /jffs/scripts/post-mount.div # Added by Diversion
# 20190303 - Added to wipe out the dcm traps in the logs
#
cru a xxx-remove-dcd-crash "11,33 * * * * /bin/sed -i '/kernel: dcd/,/kernel: x1 /d' /tmp/syslog.log "
#
# <EOF>

 

[Krvicch]

Thanks for the pointers, I ended up doing just adding the sed to the crond per the earlier mention. I just run it every 33 mins..

1) cru a xxx-remove-dcd-crash "11,33 * * * * /bin/sed -i '/kernel: dcd/,/kernel: x1 /d' /tmp/syslog.log "

The way this is defined, it runs at minute 11 and 33, not every 33 minutes.

If you want every 33 minutes, it should be:

cru a xxx-remove-dcd-crash "*/33 * * * * /bin/sed -i '/kernel: dcd/,/kernel: x1 /d' /tmp/syslog.log"

 

[gattaca]

The way this is defined, it runs at minute 11 and 33, not every 33 minutes.

If you want every 33 minutes, it should be:

cru a xxx-remove-dcd-crash "*/33 * * * * /bin/sed -i '/kernel: dcd/,/kernel: x1 /d' /tmp/syslog.log"

Ah TY.. yes I had it "*/33" at first then decided I liked knowing 11,33.

 

[Davidncali001]

I keep getting these dcd crash logs with AI protection turn on with my AC86, I tried running the script, but there was so many recommendations and changes throughout this post I am really confused at this point. I am a novice and don't have syslog-ng running.

What is the exact lines of codes I need to run this?

Thank You,
David

 

[Butterfly Bones]

I keep getting these dcd crash logs with AI protection turn on with my AC86, I tried running the script, but there was so many recommendations and changes throughout this post I am really confused at this point. I am a novice and don't have syslog-ng running.

What is the exact lines of codes I need to run this?

Thank You,
David

Post #1 of this thread has the script and tells you what file in /jffs/scripts to add it to, or you can run it from command line in terminal and it will run until you reboot. Best to add it to the script file.

 

[Davidncali001]

Thank you for clarifying.

 

[Butterfly Bones]

Thank you for clarifying.

If it is not clear enough, just ask what is not clear.

 

[Andy1932]

I thought I did this correct, but I'm still getting this every 20 min or so.

May 22 18:31:43 kernel: [00000000] *pgd=000000000300e003, *pud=000000000300e003, *pmd=000000000268b003, *pte=0000000000000000
May 22 18:31:43 kernel: CPU: 1 PID: 29521 Comm: dcd Tainted: P O 4.1.27 #2
May 22 18:31:44 kernel: Hardware name: Broadcom-v8A (DT)
May 22 18:31:44 kernel: task: ffffffc01411f480 ti: ffffffc003964000 task.ti: ffffffc003964000
May 22 18:31:44 kernel: PC is at 0xf7229f44
May 22 18:31:44 kernel: LR is at 0x1dc74
May 22 18:31:44 kernel: pc : [<00000000f7229f44>] lr : [<000000000001dc74>] pstate: 600e0010
May 22 18:31:44 kernel: sp : 00000000ffce5928
May 22 18:31:44 kernel: x12: 000000000009ff08
May 22 18:31:44 kernel: x11: 00000000f64ff024 x10: 00000000000a02ac
May 22 18:31:44 kernel: x9 : 00000000f64ff93c x8 : 00000000000a0764
May 22 18:31:44 kernel: x7 : 00000000f64ff974 x6 : 00000000000a075e
May 22 18:31:44 kernel: x5 : 0000000000000000 x4 : 00000000f64ff920
May 22 18:31:44 kernel: x3 : 0000000000000000 x2 : 00000000ffce5904
May 22 18:31:44 kernel: x1 : 000000000007c66c x0 : 0000000000000000

My post-mount file looks like this:

#!/bin/sh
swapon /tmp/mnt/router_usb/myswap.swp # Swap file created by amtm


. /jffs/scripts/post-mount.div # Added by Diversion


cru a dcd_crash "*/10 * * * * /jffs/scripts/rm_dcd_crash /tmp/syslog.log #remove dcd crash lines from syslog"

Using WinSCP, I created the rm_dcd_crash file and inserted the code.
I logged in with xshell6 and entered:

cd /jffs/scripts/
chmod +x rm_dcd_crash

I think it worked. In WinSCP, it shows as rwxr-xr-x

What am I doing wrong?

 

[cmkelley]

I thought I did this correct, but I'm still getting this every 20 min or so.

My post-mount file looks like this:

#!/bin/sh
swapon /tmp/mnt/router_usb/myswap.swp # Swap file created by amtm

. /jffs/scripts/post-mount.div # Added by Diversion

cru a dcd_crash "*/10 * * * * /jffs/scripts/rm_dcd_crash /tmp/syslog.log #remove dcd crash lines from syslog"

The First thing that leaps out at me is an ill-placed closing quote; the line in post-mount should be:

cru a dcd_crash "*/10 * * * * /jffs/scripts/rm_dcd_crash /tmp/syslog.log" #remove dcd crash lines from syslog

Note the position of the closing quote.

Using WinSCP, I created the rm_dcd_crash file and inserted the code.
I logged in with xshell6 and entered:

cd /jffs/scripts/
chmod +x rm_dcd_crash

I think it worked. In WinSCP, it shows as rwxr-xr-x

What am I doing wrong?

Did you create the rm_dcd_crash file under Windows? If so it probably has the "DOS" CRLF instead of just LF which Unix wants. You can log in with xhell6 and:

cd /jffs/scripts/
dos2unix rm_dcd_crash

Which will strip out any CRs from your file.

 

[Andy1932]

The First thing that leaps out at me is an ill-placed closing quote; the line in post-mount should be:

cru a dcd_crash "*/10 * * * * /jffs/scripts/rm_dcd_crash /tmp/syslog.log" #remove dcd crash lines from syslog

Note the position of the closing quote.

Did you create the rm_dcd_crash file under Windows? If so it probably has the "DOS" CRLF instead of just LF which Unix wants. You can log in with xhell6 and:

cd /jffs/scripts/
dos2unix rm_dcd_crash

Which will strip out any CRs from your file.

Thank you. I created the crash file with WinSCP. I tried your fixes, but I'm still getting the errors. The way I had the cru command is a copy and paste from your first post.

Also, I didn't do anything with this, because I'm not running syslog-ng.

Replace /tmp/syslog.log with /opt/var/log/messages (or wherever you're redirecting syslog to) if you're using syslog-ng.

 

[Davidncali001]

If it is not clear enough, just ask what is not clear.

Hi, I just got around to trying this script out and I'm stuck. I don't know if I am doing this correctly because I know nothing of Linux. I am trying to enter all these lines while SSH'd into my AC86 router. I plan on entering the following lines but after the initial line: #!/bin/sh I try to enter: swapon /tmp/mnt/Skynet/myswap.swp # Swap file created by amtm it tells me my device is busy and from that point on I'm stuck. I think I'm doing this all wrong but don't really know.

I planned on entering the following text into my SSH's router command line:

#!/bin/sh

swapon /tmp/mnt/Skynet/myswap.swp # Swap file created by amtm
******( at this point it tells me the device is busy and I can't continue )******

. /jffs/scripts/post-mount.div # Added by Diversion

cru a dcd_crash "*/10 * * * * /jffs/scripts/rm_dcd_crash /tmp/syslog.log" #remove dcd crash lines from syslog

cd /jffs/scripts/
chmod +x rm_dcd_crash

Is this correct? And can I enter the commands in the router or do I need some type of program like a linux distro to enter the commands into?

Thank You,

David

 

[cmkelley]

Thank you. I created the crash file with WinSCP. I tried your fixes, but I'm still getting the errors. The way I had the cru command is a copy and paste from your first post.

Also, I didn't do anything with this, because I'm not running syslog-ng.

Well, I screwed that up, didn't I? I fixed the 1st message so nobody else gets caught in my mistake. Sorry.

You did reboot the router after making the changes to post-mount, right? That only runs during the boot process. when it mounts the USB drive.

If you want to start the cron job without rebooting, just enter the (entire) 'cru a' line in xshell and it will create the cron job. Putting it in post-mount enusres it runs after a reboot. It'll run at 10 past every hour.

 

[cmkelley]

Hi, I just got around to trying this script out and I'm stuck. I don't know if I am doing this correctly because I know nothing of Linux. I am trying to enter all these lines while SSH'd into my AC86 router. I plan on entering the following lines but after the initial line: #!/bin/sh I try to enter: swapon /tmp/mnt/Skynet/myswap.swp # Swap file created by amtm it tells me my device is busy and from that point on I'm stuck. I think I'm doing this all wrong but don't really know.

I planned on entering the following text into my SSH's router command line:

#!/bin/sh

swapon /tmp/mnt/Skynet/myswap.swp # Swap file created by amtm
******( at this point it tells me the device is busy and I can't continue )******

. /jffs/scripts/post-mount.div # Added by Diversion

cru a dcd_crash "*/10 * * * * /jffs/scripts/rm_dcd_crash /tmp/syslog.log" #remove dcd crash lines from syslog

cd /jffs/scripts/
chmod +x rm_dcd_crash

Is this correct? And can I enter the commands in the router or do I need some type of program like a linux distro to enter the commands into?

Thank You,

David

You don't enter them directly into your router at the shell prompt, assuming you don't have amtm or diversion installed, you need to create a file in /jffs/scripts named post-mount that contains:

#!/bin/sh

cru a dcd_crash "*/10 * * * * /jffs/scripts/rm_dcd_crash /tmp/syslog.log" #remove dcd crash lines from syslog

If you do have installed amtm or diversion, the/jffs/scripts/post-mount script is already there and you just need to add the line that starts with "cru a ..." to it.

If you had to create the /jffs/scripts/post-mount file, you'll have to make it executable (i.e. chmod /jffs/scripts/post-mount -x). In either case you also have to create the rm_dcd_crash script and make it executable.

I'm pretty sure the nano editor is installed on asuswrt-merlin, but I've never used it, I use vi, which is needlessly complex for just creating scripts. If you don't know how to use nano there should be some tutorials on the web.

 

[Davidncali001]

OK so I do have Diversion, AMTM and Skynet installed along with a swap file that Skynet added.

I looked up how to use nano and think I got a little familiar with the basic commands.

So all I would need to do is add this line in nano:

cru a dcd_crash "*/10 * * * * /jffs/scripts/rm_dcd_crash /tmp/syslog.log" #remove dcd crash lines from syslog

and then exit nano and make it executable?

David

 

[cmkelley]

OK so I do have Diversion, AMTM and Skynet installed along with a swap file that Skynet added.

I looked up how to use nano and think I got a little familiar with the basic commands.

So all I would need to do is add this line in nano:

cru a dcd_crash "*/10 * * * * /jffs/scripts/rm_dcd_crash /tmp/syslog.log" #remove dcd crash lines from syslog

and then exit nano and make it executable?

David

Not quite. Use nano to edit post-mount. Add that line to the end of post-mount. post-mount is already executable.

Then use nano to create a new file, rm_dcd_crash in /jffs/scripts. and add:

#!/bin/sh
# remove dcd crash lines from system log

/bin/sed -i '/kernel: dcd/,/kernel: x1 /d' $1

Then save that and make it executable.

 

[Andy1932]

Well, I screwed that up, didn't I? I fixed the 1st message so nobody else gets caught in my mistake. Sorry.

You did reboot the router after making the changes to post-mount, right? That only runs during the boot process. when it mounts the USB drive.

If you want to start the cron job without rebooting, just enter the (entire) 'cru a' line in xshell and it will create the cron job. Putting it in post-mount enusres it runs after a reboot. It'll run at 10 past every hour.

I did reboot. Not sure why it's not working. I'm going to try and just run the cron job to see if it works.

 

[Andy1932]

I did reboot. Not sure why it's not working. I'm going to try and just run the cron job to see if it works.

Manually running the cron job doesn't seem to be working, either.
Are these a different kind of dcd crashes?

May 23 13:43:21 kernel: pgd = ffffffc00432f000
May 23 13:43:21 kernel: [00000000] *pgd=000000000b10f003, *pud=000000000b10f003, *pmd=00000000146c1003, *pte=0000000000000000
May 23 13:43:21 kernel: CPU: 1 PID: 24508 Comm: dcd Tainted: P O 4.1.27 #2
May 23 13:43:21 kernel: Hardware name: Broadcom-v8A (DT)
May 23 13:43:22 kernel: task: ffffffc0146c6140 ti: ffffffc00b064000 task.ti: ffffffc00b064000
May 23 13:43:22 kernel: PC is at 0xf7139f44
May 23 13:43:22 kernel: LR is at 0x1dc74
May 23 13:43:22 kernel: pc : [<00000000f7139f44>] lr : [<000000000001dc74>] pstate: 600e0010
May 23 13:43:22 kernel: sp : 00000000ffc3bab8
May 23 13:43:22 kernel: x12: 000000000009ff08
May 23 13:43:22 kernel: x11: 00000000f63ff024 x10: 00000000000a02ac
May 23 13:43:22 kernel: x9 : 00000000f63ff93c x8 : 00000000000a0764
May 23 13:43:22 kernel: x7 : 00000000f63ff974 x6 : 00000000000a075e
May 23 13:43:22 kernel: x5 : 0000000000000000 x4 : 00000000f63ff920
May 23 13:43:22 kernel: x3 : 0000000000000000 x2 : 00000000ffc3ba94
May 23 13:43:22 kernel: x1 : 000000000007c66c x0 : 0000000000000000

 

[Davidncali001]

Hey cmkelley, thank you so much for breaking it down for me and making it easier to digest. I got it working.

 

[cmkelley]

Hey cmkelley, thank you so much for breaking it down for me and making it easier to digest. I got it working.

Glad you were able to figure out my bumbling instructions.