Syslog location other than in RAM?

[kizer]

Is there a way we can change our syslog location? The reason I ask is today I tried to connect to my server and low and behold it was off. I have no idea why it was off. I checked around the house and no blinking lights as if I lost power and I do have a UPS and just checked it and it appears to be fully charged.

 

If its a power issue or a hardware issue it would be nice to have a method to attempt to trouble shoot.

 

Another USB stick or somewhere else?

[WeeboTech]

Sure update your syslog upon boot.

here is what mine looks like.

 

# Everything to syslog:

*.*                                                    -/var/log/syslog

*.*                                                    -/dev/tty12

*.*                                                    [email protected]

 

I send all messages to another host.

You can add a line to send all messages to some other drive (perhaps a scratch or apps drive).

 

you will need to prune it on your own by updating logrotate.conf

 

Here's my script to install it.

 

root@atlas ~ #cat /boot/custom/etc/rc.d/S00-syslog-update

#!/bin/bash

cp /boot/custom/etc/syslog.conf /etc/syslog.conf

read PID < /var/run/syslogd.pid

kill -1 ${PID}

dmesg | logger -tdmesg -plocal7.info -i

 

 

 

[WeeboTech]

You can also just modify the destination with a simple sed line such as.

 

sed -i -e 's#/var/log/syslog#/var/log/syslog.rob#g' /etc/syslog.conf

Just change the destination.

Then do the kill as below in the other scriptlet.

 

read PID < /var/run/syslogd.pid

kill -1 ${PID}

 

which could be condensed with

 

kill -1 $(</var/run/syslogd.pid)

 

Some people use the killall command, I prefer not to as if someone is editing something that matches it could be killed.

[WeeboTech]

You will need to run a sed and change the destination here also if you keep the file locally on a hard drive or flash.

 

root@atlas ~ #more /etc/logrotate.d/syslog

/var/log/syslog {

    size 1M

    sharedscripts

    postrotate

        /bin/kill -HUP `cat /var/run/syslogd.pid 2>/dev/null` 2>/dev/null || true

    endscript

}

[kizer]

Thanks. I'll have to dig thru all that and figure out how to tie it all together. LOL

 

I'm not running a cache disk, but figured why not burn up another usb stick opposed to my license stick.

[kizer]

WeeboTech,

I was thinking of installing another USB stick and letting it burn up opposed to running on my drives so they can stay spun down.

 

I'm guessing its a matter of mounting another USB, but I'm wondering if there is going to be a boot issue on start up. However I am considering a Cache disk now just because I see some other advantages.

[WeeboTech]

WeeboTech,

I was thinking of installing another USB stick and letting it burn up opposed to running on my drives so they can stay spun down.

 

I'm guessing its a matter of mounting another USB, but I'm wondering if there is going to be a boot issue on start up. However I am considering a Cache disk now just because I see some other advantages.

 

No it's a timing thing.

 

As long as the other flash key is mounted in the go script, then syslog can be redirected or you can have additional data written somewhere else.

 

 

[WeeboTech]

Do you have the second flash key labeled and mounted somewhere?

That's the first step.

 

If so where?

 

[kizer]

Not yet. More than likely I'll just mount it at /mnt

Probably something like /mnt/syslogdirve

 

With system shutdown is it going to have a problem shutting down, but since its not part of the array I'm guessing its not.

[mejutty]

I have been looking through this thread trying to figure out a crash i see randomly.  So based on this thread I added the following lines to my go

 

cp /boot/syslog/syslog /boot/syslog/syslog.bak

cp /var/log/syslog /boot/syslog/syslog

sed -i -e 's#/var/log/syslog#/boot/syslog/syslog#g' /etc/logrotate.d/syslog

sed -i -e 's#/var/log/syslog#/boot/syslog/syslog#g' /etc/syslog.conf

kill -1 $(</var/run/syslogd.pid)

 

backs up the old syslog, copys the current syslog to new location, makes the changes to the syslog.conf and logrotate.d then does the kill

 

seem to work as expected anyone see any issues with doing this??

[onyx00]

I have been looking through this thread trying to figure out a crash i see randomly.  So based on this thread I added the following lines to my go

 

cp /boot/syslog/syslog /boot/syslog/syslog.bak

cp /var/log/syslog /boot/syslog/syslog

sed -i -e 's#/var/log/syslog#/boot/syslog/syslog#g' /etc/logrotate.d/syslog

sed -i -e 's#/var/log/syslog#/boot/syslog/syslog#g' /etc/syslog.conf

kill -1 $(</var/run/syslogd.pid)

 

backs up the old syslog, copys the current syslog to new location, makes the changes to the syslog.conf and logrotate.d then does the kill

 

seem to work as expected anyone see any issues with doing this??

 

Form the above I got the impression that continuously writing to the boot flash drive was not a good idea as you will wear out the device.  Not that flash drives are expensive, but you don't really want to purposely degrade the flash device you are booting with.

 

I was going to try doing this with a second USB flash drive by mounting it and redirecting syslog as you and others described above.  I was also going to try getting my Tomato-based router to write its logs to that same flash drive/share.

 

I'll check back in once I finish trying to set this up.