syslog location (/tmp * /jffs)

[bengalih]

This may be a question beyond just syslog, and probably shows my ignorance on how the /tmp and /jffs filesystems are working.

It appears that the syslog.log file exists both in:

/tmp/syslog.log
and
/jffs/syslog.log

They appear to be the same file and yet they don't appear to be a link to one-another.
I don't see other files duplicated and don't see how jffs is mounted.

Can someone explain what I am seeing?

 

[ColinTaylor]

The syslog in /tmp is periodically copied to /jffs.

 

[bengalih]

The syslog in /tmp is periodically copied to /jffs.

Thanks...it must be pretty frequent as I was checking it often and it appeared the same.
Do you know:
a) What the purpose of this is?
b) What mechanism does the copy?

 

[ColinTaylor]

Thanks...it must be pretty frequent as I was checking it often and it appeared the same.
Do you know:
a) What the purpose of this is?
b) What mechanism does the copy?

a) I think historically syslog.log was always stored in /tmp. But because /tmp exists only in RAM it was lost after a reboot. So later firmwares introduced additional code that copied the syslog to /jffs so that it persisted across reboots.

b) I don't know the specifics, it varies depending on the firmware version and router model. Looking at the current Merlin code it looks like syslog in /jffs is now soft-linked to the copy in /tmp, which would explain why they both look the same.

 

[bengalih]

b) I don't know the specifics, it varies depending on the firmware version and router model. Looking at the current Merlin code it looks like syslog in /jffs is now soft-linked to the copy in /tmp, which would explain why they both look the same.

Interesting...thanks. I'm on the latest release (384.6) and they don't look soft-linked here:

admin@RT-AC68U-4C30:/tmp/home/root# find /tmp -maxdepth 1 -type l -ls
    19536      0 lrwxrwxrwx   1  admin    root           26 Aug 24 22:33 /tmp/nat_rules -> /tmp/nat_rules_vlan2_vlan2
     2497      0 lrwxrwxrwx   1  admin    root           28 Aug 24 22:14 /tmp/opt -> /tmp/mnt/flash_drive/entware
     1749      0 lrwxrwxrwx   1  admin    root            8 May  5 05:05 /tmp/wpa_cli -> /sbin/rc
     1748      0 lrwxrwxrwx   1  admin    root            8 May  5 05:05 /tmp/zcip -> /sbin/rc
     1747      0 lrwxrwxrwx   1  admin    root            8 May  5 05:05 /tmp/udhcpc -> /sbin/rc
     1741      0 lrwxrwxrwx   1  admin    root            8 May  5 05:05 /tmp/dhcp6c -> /sbin/rc
admin@RT-AC68U-4C30:/tmp/home/root# find /jffs -maxdepth 1 -type l -ls
admin@RT-AC68U-4C30:/tmp/home/root#

maybe that was just implemented and not in release yet?

 

[elorimer]

You might direct your energy to setting up syslog-ng

 

[RMerlin]

/tmp is in RAM and gets wiped out on a reboot. The file is backed up to /jffs which is in flash, and will survive a router reboot.

The writes are done in RAM to reduce the wear and tear on the flash, in case your log might get a burst of writes in a short period of time.

 

[unsynaps]

/tmp is in RAM and gets wiped out on a reboot. The file is backed up to /jffs which is in flash, and will survive a router reboot.

The writes are done in RAM to reduce the wear and tear on the flash, in case your log might get a burst of writes in a short period of time.

Ahh that makes sense. Kind of wondered why it did that.