Router rebooting every few hours - how can I find out why?

[Saturn49]

I have a MN-700 running 1.9.2.7-7b that I recently customized to run a VPN connection (details here).

Everything seems to work great, except every few hours the router reboots. It seems to be random, as the last time it happened was about 4:30 this morning when I was in bed and there was little to no traffic. It also happened under 1.9.2.7-6b. Prior to setting up the VPN, 6b had been VERY stable for me, so I know it is related to that.

The problem is, it reboots and all the logs are wiped. Can I setup a log server or something to try to catch these problems? I'm sure it is related to the VPN, maybe it runs out of memory or something - I'm not sure. What should I look for?

I setup the VPN so that eventually I can do VoIP over it, so a router that reboots randomly won't do me a lot of good.

[Saturn49]

Ok, I think I figured out what's causing it, but I don't know how to stop it:

I caught this in the syslog before it rebooted (IP addresses have been masked out.)

Mar  7 04:52:41 udhcpc[138]: Lease of 68.xxx.xxx.xxx obtained, lease time 86400
Mar  7 04:52:41 dnsmasq[97]: read /etc/hosts - 5 addresses
Mar  7 04:52:41 dnsmasq[97]: read /etc/ethers - 3 addresses
Mar  7 04:52:41 dnsmasq[97]: reading /tmp/resolv.conf
Mar  7 04:52:41 dnsmasq[97]: using nameserver 68.yyy.yyy.yyy#53
Mar  7 04:52:41 dnsmasq[97]: using nameserver 68.yyy.yyy.yyy#53
Mar  7 04:52:41 dnsmasq[97]: using nameserver 68.yyy.yyy.yyy#53
Mar  7 04:52:41 dnsmasq[97]: using nameserver 192.zzz.zzz.zzz#53 for unqualified domains
Mar  7 04:52:41 dnsmasq[97]: using nameserver 192.zzz.zzz.zzz#53 for domain mycompany.com
Mar  7 04:52:43 pppd[342]: pppd 2.4.2 started by admin, uid 0
Mar  7 04:52:43 pppd[342]: Using interface ppp1
Mar  7 04:52:43 pppd[342]: Connect: ppp1 <--> /dev/pts/4
Mar  7 04:52:43 pptp[346]: anon log[main:pptp.c:267]: The synchronous pptp option is NOT activated
Mar  7 04:52:43 pptp[202]: anon log[ctrlp_rep:pptp_ctrl.c:251]: Sent control packet type is 7 'Outgoing-Call-Request'
Mar  7 04:52:43 pptp[202]: anon log[ctrlp_disp:pptp_ctrl.c:851]: Received Outgoing Call Reply.
Mar  7 04:52:43 pptp[202]: anon warn[ctrlp_disp:pptp_ctrl.c:863]: Unexpected(?)Outgoing Call Reply will be ignored.
Mar  7 04:52:43 dhcp client: renew IP : 68.xxx.xxx.xxx from 68.xxx.xxx.1
Mar  7 04:52:51 ntp client: Synchronizing time with time.nist.gov ...
Mar  7 04:53:16 pppd[342]: LCP: timeout sending Config-Requests
Mar  7 04:53:16 pppd[342]: Connection terminated.
Mar  7 04:53:16 pppd[342]: Using interface ppp1
Mar  7 04:53:16 pppd[342]: Connect: ppp1 <--> /dev/pts/5

It keeps repeating like this up through /dev/pts/42 when it finally runs out of memory, kills init, and reboots.

So whenever it renews my DHCP lease for the WAN, it fires off pppd again for some reason on ppp1 (my VPN connection is using ppp0).

I need to suppress this behavior, which I think is caused by the script /tmp/udhcpc, which points to /sbin/rc. I'm still trying to download the code to see what exactly it is trying to do in this "script" (besides restart dnsmasq.)

[Saturn49]

It turns out the DHCP renew action fires off /usr/local/sbin/post-firewall, which is where I had placed my stuff to run pppd. So it wasn't udhcpc firing off pppd, it was actually my script. I had originally put the pppd stuff in post-firewall because the iptables rules don't work from post-boot.

So I moved pppd to run from post-boot and left the iptables stuff in post-firewall. Everything seems peachy now.