Logread messages on log server?

Hi,
i have 4 openwrt devices running in my network, all on FW 19.07.07 and all have logging enabled to my NAS with exact same settings.
But only from one of the 4 i see every 3 minutes on my NAS log server a message "logread connected to 192.168.0.10:514". Te 3 other do not do this. So i guess i have something differently configured but have no clue what.
Any hints?
thanks,
Raoul

Run a uci export system and compare the output for differences.

1 Like

I have only seen that message when a rebooting/restart is finished and connection to log server is established again?

So is that device going into some sleep mode or something, or actually continuously rebooting?

Not sure if it is going into sleep, how can i tell? It is not rebooting as that would cause other messages on the logserver.

There is one difference between the devices, not sure if that is relevant or not. This one serves as a WiFi extender, so it connects to my network through Wifi (WWAN), where my other OpenWRT devices use WAN port to connect.
I noticed this as i tried to ssh into the device. For this one the connection is refused on its WWAN address where for the other i can ssh into them using the WAN IP address. Although ssh access is configured on all interfaces. (For this reason i cannot run the uci export system on this one).
They all get their (W)WAN IP address through DHCP, which is fixed for each on the DHCP server. I can access it through http though.

Hmmmm. triggered by your replies i looked into the system log of the device and found that it is disabling its WWAN interface every 3 minutes which is causing this (and for that reason can't send the syslog messages when this happens....
So why does it go down everytimes ?

Thu Jan  6 12:52:20 2022 daemon.notice netifd: Interface 'wwan' is enabled
Thu Jan  6 12:52:20 2022 daemon.warn dnsmasq[1887]: no servers found in /tmp/resolv.conf.auto, will retry
Thu Jan  6 12:52:23 2022 daemon.notice wpa_supplicant[1754]: wlan0: SME: Trying to authenticate with 6a:d7:9a:28:dc:08 (SSID='MOHAIR_L' freq=5500 MHz)
Thu Jan  6 12:52:23 2022 kern.info kernel: [7182591.680847] wlan0: authenticate with 6a:d7:9a:28:dc:08
Thu Jan  6 12:52:23 2022 daemon.notice wpa_supplicant[1754]: wlan0: Trying to associate with 6a:d7:9a:28:dc:08 (SSID='MOHAIR_L' freq=5500 MHz)
Thu Jan  6 12:52:23 2022 kern.info kernel: [7182591.691397] wlan0: send auth to 6a:d7:9a:28:dc:08 (try 1/3)
Thu Jan  6 12:52:23 2022 kern.info kernel: [7182591.698678] wlan0: authenticated
Thu Jan  6 12:52:23 2022 kern.info kernel: [7182591.706763] wlan0: associate with 6a:d7:9a:28:dc:08 (try 1/3)
Thu Jan  6 12:52:23 2022 kern.info kernel: [7182591.714406] wlan0: RX AssocResp from 6a:d7:9a:28:dc:08 (capab=0x111 status=0 aid=8)
Thu Jan  6 12:52:23 2022 kern.info kernel: [7182591.724032] wlan0: associated
Thu Jan  6 12:52:23 2022 daemon.notice wpa_supplicant[1754]: wlan0: Associated with 6a:d7:9a:28:dc:08
Thu Jan  6 12:52:23 2022 daemon.notice wpa_supplicant[1754]: wlan0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
Thu Jan  6 12:52:23 2022 daemon.notice netifd: Network device 'wlan0' link is up
Thu Jan  6 12:52:23 2022 daemon.notice netifd: Interface 'wwan' has link connectivity
Thu Jan  6 12:52:23 2022 daemon.notice netifd: Interface 'wwan' is setting up now
Thu Jan  6 12:52:23 2022 daemon.notice wpa_supplicant[1754]: wlan0: WPA: Key negotiation completed with 6a:d7:9a:28:dc:08 [PTK=CCMP GTK=CCMP]
Thu Jan  6 12:52:23 2022 daemon.notice wpa_supplicant[1754]: wlan0: CTRL-EVENT-CONNECTED - Connection to 6a:d7:9a:28:dc:08 completed [id=0 id_str=]
Thu Jan  6 12:52:23 2022 daemon.notice netifd: wwan (617): udhcpc: started, v1.30.1
Thu Jan  6 12:52:23 2022 daemon.notice netifd: wwan (617): udhcpc: sending discover
Thu Jan  6 12:52:23 2022 daemon.notice netifd: wwan (617): udhcpc: sending select for 192.168.12.15
Thu Jan  6 12:52:23 2022 daemon.notice netifd: wwan (617): udhcpc: lease of 192.168.12.15 obtained, lease time 86400
Thu Jan  6 12:52:23 2022 daemon.notice netifd: Interface 'wwan' is now up
Thu Jan  6 12:52:23 2022 daemon.info dnsmasq[1887]: reading /tmp/resolv.conf.auto
Thu Jan  6 12:52:23 2022 daemon.info dnsmasq[1887]: using local addresses only for domain test
Thu Jan  6 12:52:23 2022 daemon.info dnsmasq[1887]: using local addresses only for domain onion
Thu Jan  6 12:52:23 2022 daemon.info dnsmasq[1887]: using local addresses only for domain localhost
Thu Jan  6 12:52:23 2022 daemon.info dnsmasq[1887]: using local addresses only for domain local
Thu Jan  6 12:52:23 2022 daemon.info dnsmasq[1887]: using local addresses only for domain invalid
Thu Jan  6 12:52:23 2022 daemon.info dnsmasq[1887]: using local addresses only for domain bind
Thu Jan  6 12:52:23 2022 daemon.info dnsmasq[1887]: using local addresses only for domain lan
Thu Jan  6 12:52:23 2022 daemon.info dnsmasq[1887]: using nameserver 192.168.12.1#53
Thu Jan  6 12:52:23 2022 user.notice firewall: Reloading firewall due to ifup of wwan (wlan0)
Thu Jan  6 12:52:24 2022 daemon.info logread[962]: Logread connected to 192.168.0.10:514
Thu Jan  6 12:55:24 2022 daemon.notice netifd: Network device 'wlan0' link is down
Thu Jan  6 12:55:24 2022 daemon.notice netifd: Interface 'wwan' has link connectivity loss
Thu Jan  6 12:55:24 2022 kern.info kernel: [7182772.217926] wlan0: deauthenticated from 6a:d7:9a:28:dc:08 (Reason: 3=DEAUTH_LEAVING)
Thu Jan  6 12:55:24 2022 daemon.notice wpa_supplicant[1754]: wlan0: CTRL-EVENT-DISCONNECTED bssid=6a:d7:9a:28:dc:08 reason=3
Thu Jan  6 12:55:24 2022 daemon.notice netifd: wwan (617): udhcpc: received SIGTERM
Thu Jan  6 12:55:24 2022 daemon.notice netifd: Interface 'wwan' is now down
Thu Jan  6 12:55:24 2022 daemon.notice netifd: Interface 'wwan' is disabled
Thu Jan  6 12:55:24 2022 daemon.info logread[962]: failed to send log data to 192.168.0.10:514 via udp

I think i solved the issue. On the WWAN interface/Wlan0 settings I disabled the setting "Disassociate on Low ACK" in Advanced settings and rebooted. Now it does not seem to disable its WWAN interface anymore. Not sure I understand this, but it seems to solve my problem....

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.