1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Dismiss Notice

Welcome To SNBForums

SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.

If you'd like to post a question, simply register and have at it!

While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!

unknown syslog copy

Discussion in 'Asuswrt-Merlin' started by wheelq, Jan 22, 2019.

  1. wheelq

    wheelq Regular Contributor

    Joined:
    Aug 26, 2015
    Messages:
    64
    I have noticed very high CPU spikes, so I did a little research.
    As it turns out, every , the following command is being issued:

    Code:
    2984 admin     1420 D    cp /tmp/syslog.log /tmp/syslog.log-1 /jffs
    
    I have checked the 1420 and it is:
    Code:
     101 admin     1420 S    /bin/sh
    
    Yes, I do lots of logging into the syslog. Here is my config launched after router reboot:

    Code:
    syslogd -m 0 -S -O /mnt/sda2/logs/new-syslog_0.1 -s 71200 -b 99 -l 7
    
    Any idea what that is? I do not have any script in scripts folder containing the cp command mentioned above.

    Thanks!
     
  2. dave14305

    dave14305 Senior Member

    Joined:
    May 19, 2018
    Messages:
    345
    It’s a Merlin feature to backup syslog.log to jffs to persist through reboots.
     
  3. ColinTaylor

    ColinTaylor Part of the Furniture

    Joined:
    Mar 31, 2014
    Messages:
    7,548
    Location:
    UK
    I think that's standard Asus code, not specific to Merlin.
     
    dave14305 likes this.
  4. dave14305

    dave14305 Senior Member

    Joined:
    May 19, 2018
    Messages:
    345
    True enough. Let’s call it a firmware feature for purposes of his concern and not a rogue bit of malware. :p
     
  5. wheelq

    wheelq Regular Contributor

    Joined:
    Aug 26, 2015
    Messages:
    64
    Ok, any idea how to disable this?
     
  6. ColinTaylor

    ColinTaylor Part of the Furniture

    Joined:
    Mar 31, 2014
    Messages:
    7,548
    Location:
    UK
    AFAIK you can't because it's baked into the watchdog process.

    I'd guess that because you've configured your router with such a large log file that there's not enough space in /jffs to write it. I'd also speculate that because the copy fails it is constantly repeating the process. I think the only practical solution would be to reduce the size of the log file.
     
  7. cmkelley

    cmkelley Senior Member

    Joined:
    Aug 11, 2015
    Messages:
    360
    Location:
    Greater Los Angeles Area, California, USizicstania
    Are you issuing a killall syslogd before staring your modified one? I'm not sure what would happen if you tried to start a second instance. Also you can disable copying the /tmp logfiles to /jffs by using:
    Code:
    rm /jffs/syslog.log && mkdir /jffs/syslog.log
    rm /jffs/syslog.log-1 && mkdir /jffs/syslog.log-1