Persisent Logs from unraid possible?


Recommended Posts

Hey guys, first of: Sorry if this was already asked, I searched but found nothing.

 

So now to my problem:

Yesterday my unraid server just shut itself down. Does not look like it crashed but I can't tell because all the log files were empty.

Only thing in them was the boot up process and everything afterwards. So I can't tell why it just shut down.

As far as I understand, logs are written to RAM so that would explain why those were empty.

 

Is there a way to have the unraid logs be persistent on my drives? I checked the Syslog Server under Settings but this seems to be for external resources writing to unraid.

Maybe I'm just missing something. Would be great if someone could lead me in the right direction so I have the logs the next time this happens.

 

Thanks & Cheers

Cherry

 

Ps. Might be that there is indeed a hint I missed for the shutdown in the diag files so I attached them.

cherrytree-diagnostics-20191015-1832.zip

Link to comment

Look here (screen capture from Settings  >>  Syslog Server):

image.png.33eca6075f1975e5633aa9f50c3823e1.png

Set this to 'Yes' and it will write your syslog to the flash drive.  Turn on the 'Help' feature ( <<  ?   >> icon on the toolbar) for more information.  I would suggest that you pull the Flash Drive and get the file off before you reboot as I am not certain if this setting survives a reboot.  

Link to comment

Hey Frank1940,

 

thanks for the fast answer. That is good to know. Do you know if there is a possibility to write that to an unraid share as well?

Would like to keep logging 24/7 but not to the flash drive because of the many unnecessary writes that might degrade the lifespan.

 

3 minutes ago, bonienl said:

It does and allows to log right from system start.

Does that mean the file won't be overwritten on reboot but rather a new one will be created?

 

Thanks & Cheers

Cherry

Link to comment
23 minutes ago, Uncledome said:

Yesterday my unraid server just shut itself down.

Did parity check start on restart?   If not, that means that it was a normal shutdown.  

 

8 minutes ago, Uncledome said:

Would like to keep logging 24/7 but not to the flash drive because of the many unnecessary writes that might degrade the lifespan.

 

I suspect that the flash drive was selected for a reason (see @Squid response for an excellent one).  The warning is there to alert folks that setting it permanently to 'Yes' is not really that great an idea.  If I had a problem, the potential reduction in the life of the drive would not concern me.  I would make a backup of the flash drivein case sometime should happen.  (You should have one anyway!!!)  The folks at LimeTech have made it very easy to automatically get a replacement license and even if you need one that does not meet the standard replacement criteria, they have always done so after an e-mail with a  statement of facts and request for replacement.   

Link to comment
3 hours ago, Frank1940 said:

Look here (screen capture from Settings  >>  Syslog Server):

image.png.33eca6075f1975e5633aa9f50c3823e1.png

Set this to 'Yes' and it will write your syslog to the flash drive.  Turn on the 'Help' feature ( <<  ?   >> icon on the toolbar) for more information.  I would suggest that you pull the Flash Drive and get the file off before you reboot as I am not certain if this setting survives a reboot.  

Is it possible to mirror the log to the cache-drive?

I have a bad feeling when I have to write on the flash...

Edited by Zonediver
Link to comment
22 minutes ago, Zonediver said:

Is it possible to mirror the log to the cache-drive?

I have a bad feeling when I have to write on the flash drive ...

If your appdata (or domains, iso, system) is on the cache drive, the local syslog can be set to write to appdata.  However, no array means no appdata, etc. so if the array does not start you still can't get to the log.  The flash drive appears to be the only currently available location outside the array.

Edited by Hoopster
  • Thanks 1
Link to comment
1 minute ago, Hoopster said:

If your appdata (or domains, iso, system) is on the cache drive, the local syslog can be set to write to appdata.  However, no array means no appdata, etc. so if the array does not start you still can't get to the log.  The flash drive appears to be the only location currently available location outside the array.

Thanks for this info Hoopster - the only thing is that my sys writes every minute to the log - thats why i asked.

Link to comment
12 hours ago, Zonediver said:

...maybe the "better" idea 😉👍

BUT: What is a remote syslog-server? I have only Windows-machines and i cant determine a path... so, how does this work?

Google    remote syslog-server    and look at the search choices and results.  From what I can deduce from looking at the results, you have to install some software on another computer to have it serve as a remote syslog-server.  Apparently, there are a fair number of 'free' options. 

Link to comment
39 minutes ago, Frank1940 said:

Google    remote syslog-server    and look at the search choices and results.  From what I can deduce from looking at the results, you have to install some software on another computer to have it serve as a remote syslog-server.  Apparently, there are a fair number of 'free' options. 

Already found one - thanks - using Kiwi SysLog-Server 😉👍

Edited by Zonediver
  • Like 1
Link to comment
4 minutes ago, bonienl said:

And the remote syslog server can be Unraid itself.

How is this set up with enough details and explanation of where to put the files and the advantages of each location?  Explain how to set it up on a single server or to a second server.  (From your reply, it appears that a server can serve as its own remote syslog server...)  Again, I would recommend posting it up the FAQ thread. 

 

PS-- I realize that this thread has moved well beyond the OP's original issue but the topic should be discussed and clarified so that this tool can be used effectively by anyone.  During the troubleshooting of an issue/problem is not the time to trying to figure out how to use a tool!

Link to comment

@bonienl Playing around, I have found a 'bug' (I hope not a 'Program Feature'!).  I set up my server to log its own syslog.  That part works fine.  However, If I reboot the system, the old existing log file is erased and overwritten with the new log file for the current reboot since they both have the same name.   I think you need to add the date and time parameters to the syslog file name so that this does not happen.  (I have no reason to think that this would not happen even if I were logging to another Unraid server.)  This becomes a problem if the troubleshooting issue is one involving spontaneous reboots, lockups or shutdowns.  (The last two being when logging to the same server.)  This might also be an issue when mirroring to the flash drive.  Do you want a bug report?

Edited by Frank1940
Link to comment
32 minutes ago, Frank1940 said:

the old existing log file is erased and overwritten with the new log file for the current reboot since they both have the same name

No, new information is appended to the existing log.

With syslog rotation disabled, the log file will grow unlimited, or when syslog rotation is enabled, it allows a max file size and file count (.1  .2  .3  etc)

Link to comment
38 minutes ago, bonienl said:

No, new information is appended to the existing log.

 

😲 OK, I just ran another test check and it appears that you are correct and any new information is appended onto the existing file.  So it appears that all of the info that is logged from before and after a system disruption (a reboot in my test case) is present in the syslog.  (I now recall that Linux/Unix does have the built-in capability of appending data onto an existing file.  Exactly how, I can't recall but, as I remember, it was easy from even from the command line. )  

Link to comment
  • 5 months later...

I've enabled a syslog server on my unraid box in appdata and set the "remote" syslog server to 127.0.0.1.  I'm hoping to store the syslog around reset issues I'm having which get lost from the ramdisk syslog.  I'm aware that any logging before the appdata share is active won't be in my syslog server but hoping it still should be in /var/logs (until it resets).

 

Goal is to use /var/log for boot problems and appdata logs for reset issues.  Does this make sense or have I missed something?  Thanks!

Link to comment
35 minutes ago, RoninTech said:

I've enabled a syslog server on my unraid box in appdata and set the "remote" syslog server to 127.0.0.1.  I'm hoping to store the syslog around reset issues I'm having which get lost from the ramdisk syslog.  I'm aware that any logging before the appdata share is active won't be in my syslog server but hoping it still should be in /var/logs (until it resets).

 

Goal is to use /var/log for boot problems and appdata logs for reset issues.  Does this make sense or have I missed something?  Thanks!

Remote should be the ip of your server.

Alternatively, why not just enable mirroring to flash? It's in the same settings page.

Link to comment
1 hour ago, testdasi said:

Remote should be the ip of your server.

Alternatively, why not just enable mirroring to flash? It's in the same settings page.

So I don't have to worry about write cycles?  If I've got pre and post active share logging covered and don't have to worry about flash writes I'm happy.  Unless I've missed something. 🙂

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.