Solved: RT-AX86U Required /jffs Restore

[gk802]

First thing this morning, I noted that my phone was not connected to my network. Android threw a "unexpected security handshake error" or something similar, and suggested a router reboot. I attempted to connect via PC/ethernet without success...connection refused. I rebooted twice before I was able to connect to the GUI via ethernet. No wifi was running and only a few processes were active. The log was empty of anything prior to the last reboot. After a bit of investigation, it was clear that /jffs had been re-initialized and was only a fraction of it's normal 6-7% space utilization. I had a recent backup, so I restored it from my flash drive, rebooted again and everything seemed then to be back to normal operation. I did not reload the firmware nor restore nvram. Unfortunately, I lost any log entries between my last log copyback (a few hours prior) and the reboot that re-initialized /jffs.

My automated backup scripts definitely saved me and got me back in business quickly, but I've never seen that happen before. My first thought is maybe a corruption from a power issue.

Any thoughts on how I might reconstruct what happened?

Update: going to mark this solved/explained. I was able to reconstruct that my router successfully wrote to a file in the usb at 04:30:00. Based on the log of my RT-AC68U, the failure began at 04:32:07. The uptime of my cable modem indicates a reboot completed at 04:32:57. It must have been a power issue, though I have never seen a power blip corrupt /jffs previously.

 

[Ripshod]

It won't immediately help with your current situation but have you considered exporting logs to a seperate syslog server?
Even a Pi would be up to the job.

 

[gk802]

It won't immediately help with your current situation but have you considered exporting logs to a seperate syslog server?
Even a Pi would be up to the job.

I should think about that, thanks. I copy log files to the USB every 12 hours and I create a .tar file of /jffs /etc and nvram once a week. I had thought that was enough, but I may have just learned that it's not.