Jump to content

Syslog location other than in RAM?


kizer

Recommended Posts

Is there a way we can change our syslog location? The reason I ask is today I tried to connect to my server and low and behold it was off. I have no idea why it was off. I checked around the house and no blinking lights as if I lost power and I do have a UPS and just checked it and it appears to be fully charged.

 

If its a power issue or a hardware issue it would be nice to have a method to attempt to trouble shoot.

 

Another USB stick or somewhere else?

Link to comment

Sure update your syslog upon boot.

here is what mine looks like.

 

# Everything to syslog:

*.*                                                    -/var/log/syslog

*.*                                                    -/dev/tty12

*.*                                                    [email protected]

 

I send all messages to another host.

You can add a line to send all messages to some other drive (perhaps a scratch or apps drive).

 

you will need to prune it on your own by updating logrotate.conf

 

Here's my script to install it.

 

root@atlas ~ #cat /boot/custom/etc/rc.d/S00-syslog-update

#!/bin/bash

cp /boot/custom/etc/syslog.conf /etc/syslog.conf

read PID < /var/run/syslogd.pid

kill -1 ${PID}

dmesg | logger -tdmesg -plocal7.info -i

 

 

 

Link to comment

You can also just modify the destination with a simple sed line such as.

 

sed -i -e 's#/var/log/syslog#/var/log/syslog.rob#g' /etc/syslog.conf

Just change the destination.

Then do the kill as below in the other scriptlet.

 

read PID < /var/run/syslogd.pid

kill -1 ${PID}

 

which could be condensed with

 

kill -1 $(</var/run/syslogd.pid)

 

Some people use the killall command, I prefer not to as if someone is editing something that matches it could be killed.

Link to comment

You will need to run a sed and change the destination here also if you keep the file locally on a hard drive or flash.

 

root@atlas ~ #more /etc/logrotate.d/syslog

/var/log/syslog {

    size 1M

    sharedscripts

    postrotate

        /bin/kill -HUP `cat /var/run/syslogd.pid 2>/dev/null` 2>/dev/null || true

    endscript

}

Link to comment
  • 2 weeks later...

WeeboTech,

I was thinking of installing another USB stick and letting it burn up opposed to running on my drives so they can stay spun down.

 

I'm guessing its a matter of mounting another USB, but I'm wondering if there is going to be a boot issue on start up. However I am considering a Cache disk now just because I see some other advantages.

Link to comment

WeeboTech,

I was thinking of installing another USB stick and letting it burn up opposed to running on my drives so they can stay spun down.

 

I'm guessing its a matter of mounting another USB, but I'm wondering if there is going to be a boot issue on start up. However I am considering a Cache disk now just because I see some other advantages.

 

No it's a timing thing.

 

As long as the other flash key is mounted in the go script, then syslog can be redirected or you can have additional data written somewhere else.

 

 

Link to comment
  • 5 weeks later...

I have been looking through this thread trying to figure out a crash i see randomly.  So based on this thread I added the following lines to my go

 

cp /boot/syslog/syslog /boot/syslog/syslog.bak

cp /var/log/syslog /boot/syslog/syslog

sed -i -e 's#/var/log/syslog#/boot/syslog/syslog#g' /etc/logrotate.d/syslog

sed -i -e 's#/var/log/syslog#/boot/syslog/syslog#g' /etc/syslog.conf

kill -1 $(</var/run/syslogd.pid)

 

backs up the old syslog, copys the current syslog to new location, makes the changes to the syslog.conf and logrotate.d then does the kill

 

seem to work as expected anyone see any issues with doing this??

Link to comment

I have been looking through this thread trying to figure out a crash i see randomly.  So based on this thread I added the following lines to my go

 

cp /boot/syslog/syslog /boot/syslog/syslog.bak

cp /var/log/syslog /boot/syslog/syslog

sed -i -e 's#/var/log/syslog#/boot/syslog/syslog#g' /etc/logrotate.d/syslog

sed -i -e 's#/var/log/syslog#/boot/syslog/syslog#g' /etc/syslog.conf

kill -1 $(</var/run/syslogd.pid)

 

backs up the old syslog, copys the current syslog to new location, makes the changes to the syslog.conf and logrotate.d then does the kill

 

seem to work as expected anyone see any issues with doing this??

 

Form the above I got the impression that continuously writing to the boot flash drive was not a good idea as you will wear out the device.  Not that flash drives are expensive, but you don't really want to purposely degrade the flash device you are booting with.

 

I was going to try doing this with a second USB flash drive by mounting it and redirecting syslog as you and others described above.  I was also going to try getting my Tomato-based router to write its logs to that same flash drive/share.

 

I'll check back in once I finish trying to set this up.

Link to comment

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...