Where is the ASUS RT-AC68U storing all it's logs?

[josh.zyman]

Hello guys,

I have an ASUS RT-AC68U with merlin firmware version 3.0.0.4.374.37_0 and I was wondering if someone knows where is it storing all it's logs?
I am interested in moving them on a mounted HDD.

I was able to move the Traffic Monitoring files to my custom location, but I have no idea on how to move the System Log, Wireless Log, DHCP leases and others (if any).

Cheers,
Josh

 

[josh.zyman]

So I did found some of the logs but some questions still remain valid:

Active Connections log:
/tmp/syscmd.log

System log(s):
/tmp/syslog.log
/jffs/syslog.log

USB log:
/tmp/usb.log

Are there other logs this router uses?
How can I move these logs to my custom location (USB mounted HDD)?

 

[sinshiva]

https://github.com/RMerl/asuswrt-merlin/wiki/Custom-config-files

[edit/] ooh, 200th post. go me

 

[josh.zyman]

https://github.com/RMerl/asuswrt-merlin/wiki/Custom-config-files

[edit/] ooh, 200th post. go me

Thanks for the link, but that one contains information about the custom .conf files, not logs.

 

[RMerlin]

95% of logging goes to syslog. The rest are either debugging logs or temporary logs. They will be located either in /tmp or in /var/lib. They can't be moved, most of them are hardcoded (since they aren't actually useful beside while debugging code).

Syscmd.log for instance isn't even a log, it's a temporary file created by some webui functions when it needs to exchange data with the router.

 

[josh.zyman]

Do you have any ideea why the System Log is both in /tmp/syslog.log and in /jffs/syslog.log ?
Is one a copy of the other?

 

[josh.zyman]

I have noticed that under Administration -> System -> Miscellaneous there an option called "Remote Log Server". I was not able to find any info in the Asus' documentation so I have to ask here, does anyone know how to use this feature?

 

[RMerlin]

I have noticed that under Administration -> System -> Miscellaneous there an option called "Remote Log Server". I was not able to find any info in the Asus' documentation so I have to ask here, does anyone know how to use this feature?

You need to run a syslog server on another server, at which point you can put the IP of that server in this field.

 

[RMerlin]

Do you have any ideea why the System Log is both in /tmp/syslog.log and in /jffs/syslog.log ?
Is one a copy of the other?

/tmp/syslog.log is the main, "live" log.

/jffs/syslog.log is a backup made so that when your router reboots, it won't lose all past log entries (/tmp is a volatile ramdisk).

 

[josh.zyman]

/tmp/syslog.log is the main, "live" log.

/jffs/syslog.log is a backup made so that when your router reboots, it won't lose all past log entries (/tmp is a volatile ramdisk).

OK, now I understand the porpoise of the /jffs/syslog.log, but isn't this killing the flash memory?
On your page about JFFS you wrote "I do not recommend doing frequent writes to this area, as it will prematurely wear out the flash RAM." and "Do not put files that get constantly written to (such as log-files)".

I have installed transmission-daemon and it writes a lot (of spam) in the log file.

If I would manage to have a remote server log, using it will stop using the jffs log?

 

[RMerlin]

OK, now I understand the porpoise of the /jffs/syslog.log, but isn't this killing the flash memory?
On your page about JFFS you wrote "I do not recommend doing frequent writes to this area, as it will prematurely wear out the flash RAM." and "Do not put files that get constantly written to (such as log-files)".

I have installed transmission-daemon and it writes a lot (of spam) in the log file.

If I would manage to have a remote server log, using it will stop using the jffs log?

I haven't looked at the details of Asus's implementation, but I believe they just keep a backup there, they don't actively write to it.

 

[josh.zyman]

I tried to make symbolic link from jffs to a folder on a mounted disk, but the link is replaced by the log file, so this is not helpful.
I noticed that the syslog.log file from jffs is written every minute.
Still digging...

EDIT: dear RMerlin, dear wizard, please give us an option in a following firmware to deactivate syslogd on Asus RT-AC68U to be able to use others like syslog-ng or metalog. And please stop forcing the log to be copied in jffs. It has 32MB, but I prefer to burn it with whatever I want, not with spam from my daemons.
I noticed that on other builds, syslogd can be deactivated by commenting two lines at /etc/inittab, but on asuswrt-merlin this file doesn't exist.

 

[frankiech]

I tried to make symbolic link from jffs to a folder on a mounted disk, but the link is replaced by the log file, so this is not helpful.
I noticed that the syslog.log file from jffs is written every minute.
Still digging...

EDIT: dear RMerlin, dear wizard, please give us an option in a following firmware to deactivate syslogd on Asus RT-AC68U to be able to use others like syslog-ng or metalog. And please stop forcing the log to be copied in jffs. It has 32MB, but I prefer to burn it with whatever I want, not with spam from my daemons.
I noticed that on other builds, syslogd can be deactivated by commenting two lines at /etc/inittab, but on asuswrt-merlin this file doesn't exist.

I'd also like an option to disable the syslog on jffs. I'll do another PayPal donate if this happens. *hint* *hint*

 

[JEWBSV]

I support

 

[sammyano]

There should be an option to enable or disabled logging within the router - I remember Rmerlin mentioned in another thread that it's not top of his to do list now, so lets hope he would come around it sometime soon

 

[Rexcellent]

... I remember Rmerlin mentioned in another thread...

In that thread, someone came up with a great idea to simply remount /jffs as read-only in the init-start script. Works well for me. Here is the link.

I took it a step further by adding a command to my post-mount script that then mounts /jffs to a folder on my usb drive.

 

[Beaker1024]

Rexcellent - Thanks for the information. I like the idea of just having the logs written to an attached USB thumb drive.

The link to the other thread where instructions for mounting /jffs as read only has very detailed instructions!

Can you share similar instructions on how you modified the post-mount script to have the mounting moved to the USB drive?

I admit I've only ever used the WebGUI on opensource router firmware so it would greatly assist those of us with less experience.

Thank you!

 

[Rexcellent]

Here's a link to the additions.

Cheers

 

[sam and the fam]

Maybe there is a way to clear the log by using a different firmware, for instance maybe DD-WRT, and then reverting back to Merlin firmware (and restoring backed up config, of course)?

 

[RMerlin]

You just answered a 7 years old thread...

You can delete the log from the System Log page itself.