How to send Syslog to a non-boot USB key

[couzin2000]

I kept searching for a few days but I can't seem to find the topic correctly.

Currently using Unraid 6.11.5. Running smoothly but I still want to monitor the system log from time to time. However there is very little recorded onto my syslog, as it is only in RAM. I'd like to add a separate USB thumbdrive and point the syslog to record logs to it. 
I think my main issue here is that I can't create a Pool device out of that thumbdrive and then hotswap it whenever I need to read its contents. Because it's a pool, I keep thinking it will not be readable from my main Win10 workstation.

So how do I send the syslog to the USB key so that I can remove it whenever I want and hard-read it from a different PC?
I need configuration how-to steps, if they're available.
Thank you!

[JorgeB]

You can use the syslog server to send it to a share or another server.

[Frank1940]

@bonienl, is this something that could be added to the Syslog Server?  Or do you have a thought about mounting a USB flash drive as a Pool?

Edited November 19, 2023 by Frank1940

[Kilrah]

You should be able to mount as UD, but things will probably break when mounting/unmounting it in OP's scenario. Why not just write to a share and access it via the network?

[Frank1940]

6 minutes ago, Kilrah said:

You should be able to mount as UD, but things will probably break when mounting/unmounting it in OP's scenario. Why not just write to a share and access it via the network?

The big disadvantage to writing it a share is the possible delay in waiting to spin up a HD and the problem with the data being caught in the write cache if the condition you are trying to catch is a lock-up or something similar.   That was the reason for suggesting using a SSD cache drive when the FAQ was written back in 2019. 

[Kilrah]

4 hours ago, Frank1940 said:

The big disadvantage to writing it a share is the possible delay in waiting to spin up a HD

Never said you'd set syslog to write to an HDD-backed share, that's the last thing you'd want... cache-only/prefer share of course.

[Frank1940]

Request from OP:

23 hours ago, couzin2000 said:

So how do I send the syslog to the USB key so that I can remove it whenever I want and hard-read it from a different PC?

Comment In Thread:

1 hour ago, Kilrah said:

6 hours ago, Frank1940 said:

The big disadvantage to writing it a share is the possible delay in waiting to spin up a HD

Never said you'd set syslog to write to an HDD-backed share, that's the last thing you'd want... cache-only/prefer share of course.

 

@couzin2000, if you do as suggested (Even if you have to make a cache only share for the syslog) and export that share, you would be able to read it anytime when the server is running.  (The syslog server opens and closes that file for each write.)    The only time when it would not be available is if the server crashed.  You have not indicated that you needed to be able to address that particular issue.  By the way, I am assuming that you know that when the system restarts, the syslog server will be appending any new writes onto that file.  So you do have to monitor it as it will continue to grow.  (You don't want it get so large that finding something in it becomes a real issue in its self.)

 

 

[Hoopster]

On 11/18/2023 at 4:24 PM, couzin2000 said:

So how do I send the syslog to the USB key so that I can remove it whenever I want and hard-read it from a different PC?

I followed this procedure to send the syslog to a USB flash drive mounted as an unassigned device.

Edited November 22, 2023 by Hoopster

[couzin2000]

On 11/19/2023 at 6:37 PM, Frank1940 said:

Request from OP:

Comment In Thread:

 

@couzin2000, if you do as suggested (Even if you have to make a cache only share for the syslog) and export that share, you would be able to read it anytime when the server is running.  (The syslog server opens and closes that file for each write.)    The only time when it would not be available is if the server crashed.  You have not indicated that you needed to be able to address that particular issue.  By the way, I am assuming that you know that when the system restarts, the syslog server will be appending any new writes onto that file.  So you do have to monitor it as it will continue to grow.  (You don't want it get so large that finding something in it becomes a real issue in its self.)

 

 

The only disadvantage I can see is not being able to boot after a critical failure, therefore having to use the backup from the boot device without seeing what can be at fault in the log. This is why I'd rather have the log be removeable and readable elsewhere.

[Frank1940]

On 11/19/2023 at 11:58 PM, Hoopster said:

I do this to send the syslog to a USB flash drive mounted as an unassigned device.

this  =   https://forums.unraid.net/topic/104938-syslog-to-ntfs-kingston-card-reader-unassigned-device/

 

@couzin2000, did you try the method suggested by @Hoopster.   It seems to meet all of your requirements...

Edited November 21, 2023 by Frank1940

[Hoopster]

21 hours ago, Frank1940 said:

this  =   https://forums.unraid.net/topic/104938-syslog-to-ntfs-kingston-card-reader-unassigned-device/

 

@couzin2000, did you try the method suggested by @Hoopster.   It seems to meet all of your requirements...

I updated the post a bit to hopefully make it more clear there was a link in it.  I can see how that would be missed.

[couzin2000]

44 minutes ago, Hoopster said:

I updated the post a bit to hopefully make it more clear there was a link in it.  I can see how that would be missed.

I just had a chance to skim the surface of your post, but it looks like it would work for sure. I'll test this later today and report back. Thank you!!