Syslog File Management

[abeta]

I did a search for syslog and log and got a bunch of hits but nothing that I was looking for.

 

How are people managing their syslogs? I see some people have older syslog files so I assume they're managing it somehow since I see only one syslog file?

 

Is there a good way for me to manage say the last 3 or 5 unRaid startups?

[starcat]

Shouldn't be very hard at powerdown to save the file to a different name, or something like this...

[Joe L.]

The syslog is created in a in-memory file-system.  If it grows too large, at some time in the middle of the night it is moved to syslog.1 and a new syslog file created.  I think it only keeps 1 old copy, but it is rare for a syslog to be moved, unless there are lots of errors or extra logging enabled.  I can only remember it happening once here.

 

When you reboot, the old logs are gone, and a new one started.

 

If you install the WeeboTech created "powerdown" add-on, and use it to power down, then it will save the last 6 syslogs to your flash drive (I think it is 6)

[starcat]

Joe, thanks for the clarification and insights.

[abeta]

The syslog is created in a in-memory file-system.   If it grows too large, at some time in the middle of the night it is moved to syslog.1 and a new syslog file created.  I think it only keeps 1 old copy, but it is rare for a syslog to be moved, unless there are lots of errors or extra logging enabled.  I can only remember it happening once here.

 

When you reboot, the old logs are gone, and a new one started.

 

If you install the WeeboTech created "powerdown" add-on, and use it to power down, then it will save the last 6 syslogs to your flash drive (I think it is 6)

 

Eh? I use powerdown but I didn't see anything extra in /var/log the other day and I used powerdown at least 3 or 4 times in the past week? Does it put it somewhere else? I'm not at home to poke around the flash drive at the moment so I apologize if its blatantly obvious .

[starcat]

WeeboTech powerdown... this is not the standard powerdown. Just browse the forum and isntall it. It is much better than the standard powerdown anyway.

[abeta]

WeeboTech powerdown... this is not the standard powerdown. Just browse the forum and isntall it. It is much better than the standard powerdown anyway.

 

Its not the one that is installed inside of unmenu? That thread said it was a new unmenu package from Weebotech?

[purko]

The syslog is created in a in-memory file-system.   If it grows too large, at some time in the middle of the night it is moved to syslog.1 and a new syslog file created.  I think it only keeps 1 old copy, but it is rare for a syslog to be moved, unless there are lots of errors or extra logging enabled.  I can only remember it happening once here.

 

When you reboot, the old logs are gone, and a new one started.

 

If you install the WeeboTech created "powerdown" add-on, and use it to power down, then it will save the last 6 syslogs to your flash drive (I think it is 6)

 

I didn't see anything extra in /var/log ... Does it put it somewhere else?

 

As it says in the post you quoted, it saves them to your flash drive.

 

 

[purko]

Sometimes your server may seriously crash, and you don't have any chance for a nice powerdown. The log will be lost.

So here is a different solution, with which you'll have the logs on the flash, no matter what craps out:

http://lime-technology.com/forum/index.php?topic=5158.msg47760#msg47760

 

 

[Joe L.]

Sometimes your server may seriously crash, and you don't have any chance for a nice powerdown. The log will be lost.

So here is a different solution, with which you'll have the logs on the flash, no matter what craps out:

http://lime-technology.com/forum/index.php?topic=5158.msg47760#msg47760

 

 

One issue you will face if you write the log to the flash drive is that flash drives have a limited number of "write" cycles.  Some will allow as many a 1 million write cycles.    My current syslog has less than 10,000 lines, but we've seen others posed in requests for assistance that were huge.  It really depends on how often you reboot. 

 

You will age the drive more quickly if it is being used for all syslog messages.  Since it it tied to your license key, I'd use a second key or one of your data disks to log to.  It is much easier than replacing your license when the flash drive dies an early death.

 

The boot drive is fine for short term logging, but I'd recommend /mnt/disk1/syslog for long term use.

[purko]

Sometimes your server may seriously crash, and you don't have any chance for a nice powerdown. The log will be lost.

So here is a different solution, with which you'll have the logs on the flash, no matter what craps out:

http://lime-technology.com/forum/index.php?topic=5158.msg47760#msg47760

 

 

One issue you will face if you write the log to the flash drive is that flash drives have a limited number of "write" cycles.  Some will allow as many a 1 million write cycles.     My current syslog has less than 10,000 lines, but we've seen others posed in requests for assistance that were huge.

...which will make a 1GB flash disk wear out in about 14 years.

 

...Since it it tied to your license key, I'd use a second key or one of your data disks to log to.

It is much easier than replacing your license when the flash drive dies an early death.

 

That's a very good point.  A second flash key just for your logging purposes is maybe the best solution.

Or, mount a disk share from another server and log there.  In any case, the basic idea is still the same.

 

The boot drive is fine for short term logging, but I'd recommend /mnt/disk1/syslog for long term use.

 

I thought about that. But the thing is, it may be disk1 that craps out. So I went with the flash key.

And yes, I did mean it as a short-term solution, when I postet at that thread about the guy's server severely crashing.

 

Purko

 

 

[wholly]

But it is protected by the parity disk and can be rebuilt - where the USB key is not protected. (grin)

[abeta]

Ah ok, thanks! I was looking in the wrong place.

 

I've booted my server a few times the last few days only because I've been replacing my drives. Normally it shouldn't need to be rebooted too often as it's also on a UPS so writing to the flash drive seems fine for me for the time being.

 

I bought 2 flash drives anyway from Lime Tech as well.

 

[purko]

But it is protected by the parity disk and can be rebuilt - where the USB key is not protected. (grin)

 

When it hits the fan, you need the logs in order to rebuild properly.

And in your case, they won't be accessible before you rebuild.

See the circular problem? 

When things go bad, it's often the flash key that's the only accessible thing.

(or your out-of array disk)

 

[purko]

You will age the drive more quickly if it is being used for all syslog messages.  Since it it tied to your license key, I'd use a second key or one of your data disks to log to.  It is much easier than replacing your license when the flash drive dies an early death.

 

BTW, that's where the powerdown script is saving the logs too, isn't it?

 

 

[Joe L.]

But it is protected by the parity disk and can be rebuilt - where the USB key is not protected. (grin)

 

When it hits the fan, you need the logs in order to rebuild properly.

And in your case, they won't be accessible before you rebuild.

See the circular problem? 

When things go bad, it's often the flash key that's the only accessible thing.

(or your out-of array disk)

 

Good point.   A small spare disk not in the array would be perfect... but then, as long as you don't log millions of error messages, so will the flash drive.    Base on the /etc/syslog.conf file, the log device is not "synced" after every write, so the disk buffering will help some.

 

Joe L.

 

When you are in a real pickle, you can set up a syslog service on another PC and have the log written to it over the LAN.

[Joe L.]

BTW, that's where the powerdown script is saving the logs too, isn't it?

True, but by the time my server is power cycled a million times I'll probably need a new server anyway.

The power-down script is not writing one line at a time.  It is writing the whole log at once.

 

We do write to the flash drive now every time we start and stop the array.  It is where the "md" device superblock is stored, in config/super.dat.

 

Joe L.

[purko]

Base on the /etc/syslog.conf file, the log device is not "synced" after every write, so the disk buffering will help some.

 

I noticed that.  I intentionally disabled that buffering, because that guy's server was crashing really bad, so I wanted to capture every possible log entry.

 

Purko