<div id="RTEContent">Hi Alfred,<br><br><b><i>alfred hitch <alfred.hitch@gmail.com></i></b> wrote:<blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"> Hi Rushi,<br><br>thanks for your response.<br>We were invoking syslogd without any options. So, that will solve the<br>reap size etc.<br><br>1) BUT, the bigger issue of logs not coming still remain. Observations / test sequence is very simple.<br><br>-> syslogd &<br>-> programs / daemons writting using syslog() functions.<br>-> tail -f /var/log/messages &<br>-> We can see logs on screen till messages isnt moved to messages.old<br>After that we have to issue another tail -f /var/log/messages.<br>Last tail will also work only till another round of reap.<br><br>I am surprised noone has observed this. Is everyone using a big log file on their boxes ?<br></blockquote>This would happen on any unix machine. The tail program<br> never reopens the file
being monitored. So when syslogd<br> rotates the log file(s), tail is left behind monitoring the wrong<br> log file.<br> <br> Step 1. The syslogd program in busybox checks the size each<br> time something is to be written to the current logfile. If the size<br> is too big it rotates the files. <br> mv __LOG_FILE.(n-1) __LOG_FILE.(n)<br> mv __LOG_FILE.(n-2) __LOG_FILE(n-1)<br> ....<br> ..<br> mv _LOG_FILE __LOG_FILE.0<br> <br> Step 2. Syslogd then opens a new logfile<br> Step 3. It starts writting to the new log file.<br> <br> So in your case if you pass no arguments to syslogd on startup<br> the default is to retain only one log file.<br> <br> Step 1. mv /var/log/messages /var/log/messages.0<br> Step 2. create a new log file /var/log/messages.<br> Step 3. append log message to /var/log/messages.<br> <br> Tail is still looking at /var/log/messages.0 after the first<br> rotation, but after the 2nd rotation the reference to the<br> file is removed
from the filesystem.<br> <blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"><br>2) If one is to not write to flash very often for log messages. How does one works around to get messages across reboots for crashes / other info etc ? delayed writes (again will miss out of last cycle before crash ?)?<br> </blockquote> If you can log to another machine that would be best. <br> <br> Otherwise you have to write to the flash. You could write a<br> cron job that checks for the existance of /var/log/messages.0,<br> filters it for stuff you want to monitor, write the report to flash<br> and then removes /var/log/messsages.0<br> <br> Depending on how/why your system crashes, you could partition<br> your ram into a ram disk and then on boot up check if the ram<br> disk had a valid logfile in it.<br> <br>
Max Okumoto<br> <br> <blockquote class="replbq" style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;"><br>Regards,<br>Alfred<br><br><br>On 12/23/05, Rushi Lala <rushi.lala @gmail.com=""> wrote:<br>> Usage: syslogd [OPTION]...<br>><br>> Linux system and kernel logging utility.<br>> Note that this version of syslogd ignores /etc/syslog.conf.<br>><br>> Options:<br>> -m MIN Minutes between MARK lines (default=20, 0=off)<br>> -n Run as a foreground process<br>> -O FILE Use an alternate log file (default=/var/log/messages)<br>> -S Make logging output smaller.<br>> -s SIZE Max size (KB) before rotate (default=200KB, 0=off)<br>> -b NUM Number of rotated logs to keep (default=1,<br>> max=99, 0=purge)<br>> -R HOST[:PORT] Log to IP or hostname on PORT (default
PORT=514/UDP)<br>> -L Log locally and via network logging (default<br>> is network only)<br>> -C [size(KiB)] Log to a circular buffer (read the buffer using logread)<br>><br>><br>> I am using following options when i fire syslogd daemon from rcS<br>> /etc/init.d/rcS<br>><br>> klogd &<br>> syslogd -m 120 -S -s 250 -b 2 &<br>><br>> -m 160 Minutes between MARK lines (default=20, 0=of)<br>> -S Make logging output smaller.<br>> -s 250KB Max size (KB) before rotate (default=200KB, 0=off)<br>> -b 2 Number of rotated logs to keep (default=1, max=99, 0=purge)<br>><br>> tail -f should work if syslogd is updating the log file..........How<br>> do you test this , i mean what events do you use to generate the<br>> messages ?<br>><br>> Rushi<br>><br>> On 23/12/05, alfred hitch <alfred.hitch @gmail.com=""> wrote:<br>> > Hi,<br>> ><br>> >
We have just started using busybox syslogd and tail etc ..<br>> > 2 Questions:<br>> ><br>> > 1) How to change the reap size after which syslogd shifts messages<br>> > from /var/log/messages to messages.old ? and then removes altogether ?<br>> > any option possible for runtime to syslogd<br>> ><br>> > 2) If I do a tail -f /var/log/messages and this file is "reap" ed in background.<br>> > I dont see any logs coming on screen, of course they are still going<br>> > to messages file. But, how to keep on getting these on screen also ..<br>> > some file handling desc. invalid issue ? any work arounds ?<br>> ><br>> > Regards,<br>> > Alfred<br>> > _______________________________________________<br>> > busybox mailing list<br>> > busybox@busybox.net<br>> > http://busybox.net/cgi-bin/mailman/listinfo/busybox<br>> ><br>><br>_______________________________________________<br>busybox
mailing list<br>busybox@busybox.net<br>http://busybox.net/cgi-bin/mailman/listinfo/busybox<br></alfred.hitch></rushi.lala></blockquote> <br></div>