/usr/bin/eventslog missing in RUT_00_07.xx

We are using a script on the router where we read the eventslog and create additional events.
Up to Version 06.xx everything works perfect, in Version 07.xx eventslog isn’t available anymore.

Why ?

We read and transfer the events to our database, to archive them for our customers.
In Version 06 i can use the command:

Reading
/usr/bin/eventslog -p -t EVENTS -o ID -q “WHERE ID > xyz”

Add own event
/usr/bin/eventslog -i -t EVENTS -n “MYNAME” -e “This is my own event text”

How to do this in Version 07.xx?

BR, Ronald

Hello,

The transition from version 06.xx to 07.xx marked a major firmware upgrade, with 06.xx now considered legacy. This update brought about significant changes in file structure and overall functionality.

Currently, log files can be located in the /log/log.db file.

Best regards,

Marijus

Dear Marijus,

thanks for your fast reply.

Do you have CLI examples / wiki how to:

  1. read log.db via CLI
  2. add own events to logfile

On the same router I’ve also the problem of “no space left on the device”. I can’t save OpenVPN certificates. Shall I create a new topic for this?

BR, Ronald

Hello,

I’m sorry to say that we don’t have any examples of using log.db in that way because it’s not the intended use of log.db. Generally, tampering with log databases is not advised because it can corrupt the log data.

If you really need to edit it, you can access it using scripting, for example, Python with the sqlite3 library.

Regarding the “No space left on the device” issue, could you please specify which device you are using and what files you are storing? If you’re using the same device where you write to the log file, it’s inevitable that memory would fill up, as only selected important logs are written in event logs. Depending on the device, you can expand its memory via USB or, in some cases, an SD card.

Best regards,

Marijus

Hi Marijus,

ok, may be i will compile my own binary to access log.db (similar to eventlogs in Version 06.xx) in future.

Regarding no space left issue:

Device: RUT950
Kernel: 5.4.259
Firmware: RUT9_R_00.07.06.6
Build: 9cf5346253
Build date: 2024-02-29 12:44:10
Serial: 1117060496
Batch: 0123

The customer installed this router 1 month ago, yesterday I’ve tried to setup OpenVPN but the router didn’t save the files (OpenVPN Cert files: ta.key, ca.crt, user.crt, user.key). After using the solution from https://community.teltonika-networks.com/55449/rut-950-flash-full I was able to free up a few kBytes to safe the files.

BUT after a reboot of the router the files appears again with the same result: no space left on the device.
My company and our customers having more than 2000 RUT 9xx / RUT 240 installed in the last 10 years (if you like I can provide more details in a private message) and we had never such big problems as in Version 07.xx…

df -h
Filesystem Size Used Available Use% Mounted on
/dev/root 10.9M 10.9M 0 100% /rom
tmpfs 61.0M 1.7M 59.3M 3% /tmp
/dev/mtdblock6 2.7M 2.6M 60.0K 98% /overlay
overlayfs:/overlay 2.7M 2.6M 60.0K 98% /
/dev/mtdblock7 576.0K 288.0K 288.0K 50% /log
tmpfs 512.0K 0 512.0K 0% /dev

du -sh * | sort -n
0 dev
0 mnt
0 proc
0 sys
0 var
1.1M www
1.7M tmp
2.4M etc
3.2M overlay
5.0K default.md5
6.8M lib
20.4M usr
30.1M rom
142.5K root
460.5K log
545.5K bin
701.5K default.tar.gz
707.0K sbin

du -sb /overlay/upper/etc/profiles/ * | sort -n
5.0K /overlay/upper/etc/profiles/default.md5
5.0K /overlay/upper/etc/profiles/template.md5
312.0K /overlay/upper/etc/profiles/template.tar.gz
417.5K /overlay/upper/etc/profiles/default.tar.gz
796.0K /overlay/upper/etc/profiles/var

If you’re using the same device where you write to the log file, it’s inevitable that memory would fill up, as only selected important logs are written in event logs

→ we don’t because up to now I don’t know how to do this without /usr/bin/eventlogs.

BR, Ronald

Hello,

Could you please provide information on the number of devices that were affected? Were these devices just reinstalled with the 07.xx firmware or had they been running for a while? Additionally, did they have any additional logging or other implementations where data was being saved?

Best regards,

Marijus

Hi Marijus,

actually we simply keep the devices running with latest Version 06 (approx. 65% of 1300 pcs) and testing migration to 07 step by step (25%) because I’m afraid of migrating untested to 07. Lot of them installed far away from us. If we loose VPN / mobile access we have to send a someone with a laptop to the router.

This Router we talk about has no changes from our side, latest FOTA 07 firmware. Customer contact us, because he wasn’t able to setup OpenVPN tunnel, message “no space left on device”. So we start to check why and the only way to upload the certs was to remove the profiles files. What is needed to check why /overlay is fully used?

BR, Ronald

du -h /overlay
12.5K /overlay/upper/etc/easy-rsa
512 /overlay/upper/etc/iproute2
512 /overlay/upper/etc/certificates/status
512 /overlay/upper/etc/certificates
512 /overlay/upper/etc/xl2tpd
77.0K /overlay/upper/etc/config
21.0K /overlay/upper/etc/strongswan.d/charon
36.0K /overlay/upper/etc/strongswan.d
1.0K /overlay/upper/etc/hotplug.d/iface
0 /overlay/upper/etc/hotplug.d/usb
0 /overlay/upper/etc/hotplug.d/gsm
1.0K /overlay/upper/etc/hotplug.d
1.0K /overlay/upper/etc/ppp
0 /overlay/upper/etc/hostapd
512 /overlay/upper/etc/openvpn
512 /overlay/upper/etc/profile.d
13.0K /overlay/upper/etc/vuci-uploads
512 /overlay/upper/etc/crontabs
796.0K /overlay/upper/etc/profiles/var
1.5M /overlay/upper/etc/profiles
2.0K /overlay/upper/etc/dropbear
14.5K /overlay/upper/etc/ssl
1.0K /overlay/upper/etc/opkg/keys
1.0K /overlay/upper/etc/opkg
0 /overlay/upper/etc/uci-defaults/etc
0 /overlay/upper/etc/uci-defaults/7.3
0 /overlay/upper/etc/uci-defaults/7.5
0 /overlay/upper/etc/uci-defaults/7.6.2
0 /overlay/upper/etc/uci-defaults/7.6
0 /overlay/upper/etc/uci-defaults/7.6.3
0 /overlay/upper/etc/uci-defaults/linux
0 /overlay/upper/etc/uci-defaults
512 /overlay/upper/etc/backup
1.9M /overlay/upper/etc
0 /overlay/upper/root/gz
142.5K /overlay/upper/root
136.0K /overlay/upper/usr/share/mobifd
136.0K /overlay/upper/usr/share
328.0K /overlay/upper/usr/lib/mdcollectd
328.0K /overlay/upper/usr/lib
464.0K /overlay/upper/usr
0 /overlay/upper/log
3.2M /overlay/upper
0 /overlay/work/work
0 /overlay/work
3.2M /overlay

Hello,

When you install something or delete files on your device, they take up space in the “/overlay” directory, except for temporary files stored in RAM. Most of the space on your client’s system is occupied by files like “1.5M /overlay/upper/etc/profiles” and “1.9M /overlay/upper/etc”. These are likely files related to client packages or configurations, as system-generated files are usually not stored in long-term memory but in “/tmp”.

It’s important to note that RUT9xx and RUT2xx series devices have limited flash space, with only a few spare MB available. Therefore, every MB counts. It’s worth checking for any unnecessary packages or profiles on the system.

Version 00.07 has been around for a while and has received numerous updates. It is recommended when upgrading from version 00.06 to 00.07 to do it without keeping settings, and with a few firmware jumps instead of going straight to the newest firmware. Upgrading with keep settings on might have resulted in some leftover packages or other information.

Best regards,

Marijus

At least on the latest 07.06 you can use ubus commands to access the log database.

For example you can view events like this:

ubus call log read_db '{"table":"EVENTS"}'

To figure out all the log commands run:

ubus -v list log

This topic was automatically closed after 15 days. New replies are no longer allowed.