Write syslog to unassigned drive?

[sonofdbn]

I'm trying to look at what's going wrong on my server, and previously enabled the local syslog server, writing to my cache disk as outlined here:

https://forums.unraid.net/topic/46802-faq-for-unraid-v6/page/2/?tab=comments#comment-781601. (It's in the FAQ for unRAID v6 topic.)

 

The problem is that my cache drive might be part of the problem, so I'd like to avoid writing to it. Is there a way of writing the local syslog folder to an unassigned device? I have an unassigned SSD which I could use. When I try to select a local syslog folder through the GUI, I only get a choice of shared folders.

 

 

[JorgeB]

You can mirror he syslog to the flash drive or to the array, AFAIK you can't use devices outside user shares.

[bonienl]

Though, I don't recommend to write logs to unassigned devices, it is possible to do.

 

You need to manually edit the file /config/rsyslog.cfg on your USB device and change the setting "server_folder" to the desired destination.

Restarting the syslog server is required to take the new setting into account and the GUI will display "custom" as location.

 

[Hoopster]

On 4/27/2020 at 6:11 AM, bonienl said:

Though, I don't recommend to write logs to unassigned devices, it is possible to do.

Is this still possible? 

 

I have an unassigned flash disk called SYSLOG to which syslog was writing to a <custom> location. 

• I changed the server_folder line in /boot/config/rsyslog.cfg to point to the UD location:  server_folder="/mnt/disks/SYSLOG/"
• In rsyslog.conf, changed the $template remote variable to point to the UD location: $template remote,"/mnt/disks/SYSLOG//syslog-%FROMHOST-IP%.log"

This quit working for me a couple days ago and reverted to an Unraid share.  Making the above changes and restarting the syslog server just changes the above line back to reference the share.  It appears <custom> no longer works.

 

Has something changed?  Perhaps it is related to a recent change in the Unassigned Devices plugin as that has been updated several times the past couple of weeks.

 

[JonathanM]

9 hours ago, Hoopster said:

This quit working for me

I can't solve that part of the question, but I can offer a workaround. Since there is no limit on additional pools, why not just assign the flash drive to a single device pool, call it logs or something?

 

It's not like it has to be an unassigned device for removal purposes, since if the server is running it needs to be attached, and when the server is shut down and you need to read the logs it won't matter that it's in a pool.

 

The only issue I can think of is if you need to read it on a windows system for some reason, in which case just use BTRFS and install https://github.com/maharmstone/btrfs

[itimpi]

The advantage of a ‘Custom’ path was that it could be something you mounted in the ‘go’ file and unmounted in the ‘stop’ file so it is not dependent on the array being started.

[JonathanM]

34 minutes ago, itimpi said:

The advantage of a ‘Custom’ path was that it could be something you mounted in the ‘go’ file and unmounted in the ‘stop’ file so it is not dependent on the array being started.

I hadn't thought of that, great point!

 

Mounting with Unassigned Devices still requires the array to be started AFAIK, so whether it's UD or a pool is going to be the same in that regard, neither will allow logging to continue during shutdown.

[Hoopster]

12 hours ago, JonathanM said:

The only issue I can think of is if you need to read it on a windows system for some reason,

Yeah, that was the biggest reason I set it up as an unassigned device.  I formatted it as NTFS so I could just pull it out of the server and read it natively in Windows, if needed.

 

I have a similar setup on my other two Unraid servers and the UD syslog is working fine so there is something specific that changed on the affected server.  <custom> no longer shows as the syslog location on any of the three servers, but, two are working as expected and one is not.

Edited March 23 by Hoopster