syslog basic querry

Max Okumoto max at
Tue Dec 27 17:47:04 UTC 2005

Hi Alfred,

alfred hitch <alfred.hitch at> wrote: Hi Rushi,

thanks for your response.
We were invoking syslogd without any options. So, that will solve the
reap size etc.

1) BUT, the bigger issue of logs not coming still remain. Observations / test sequence is very simple.

-> syslogd &
-> programs / daemons writting using syslog() functions.
-> tail -f /var/log/messages &
-> We can see logs on screen till messages isnt moved to messages.old
After that we have to issue another tail -f /var/log/messages.
Last tail will also work only till another round of reap.

I am surprised noone has observed this. Is everyone using a big log file on their boxes ?
This would happen on any unix machine.  The tail program
 never reopens the file being monitored.  So when syslogd
 rotates the log file(s), tail is left behind monitoring the wrong
 log file.
 Step 1. The syslogd program in busybox checks the size each
 time something is to be written to the current logfile.  If the size
 is too big it rotates the files.   
 mv __LOG_FILE.(n-1)  __LOG_FILE.(n)
 mv __LOG_FILE.(n-2)  __LOG_FILE(n-1)
 Step 2. Syslogd then opens a new logfile
 Step 3. It starts writting to the new log file.
 So in your case if you pass no arguments to syslogd on startup
 the default is to retain only one log file.
 Step 1. mv /var/log/messages /var/log/messages.0
 Step 2. create a new log file /var/log/messages.
 Step 3. append log message to /var/log/messages.
  Tail is still looking at /var/log/messages.0 after the first
 rotation, but after the 2nd rotation the reference to the
 file is removed from the filesystem.
2) If one is to not write to flash very often for log messages. How does one works around to get messages across reboots for crashes / other info etc ? delayed writes (again will miss out of last cycle before crash ?)?
  If you can log to another machine that would be best. 
 Otherwise you have to write to the flash.  You could write a
 cron job that checks for the existance of /var/log/messages.0,
 filters it for stuff you want to monitor, write the report to flash
 and then removes /var/log/messsages.0
 Depending on how/why your system crashes, you could partition
 your ram into a ram disk and then on boot up check if the ram
 disk had a valid logfile in it.
                                   Max Okumoto

On 12/23/05, Rushi Lala  wrote:
> Usage: syslogd [OPTION]...
> Linux system and kernel logging utility.
> Note that this version of syslogd ignores /etc/syslog.conf.
> Options:
>         -m MIN          Minutes between MARK lines (default=20, 0=off)
>         -n              Run as a foreground process
>         -O FILE         Use an alternate log file (default=/var/log/messages)
>         -S              Make logging output smaller.
>         -s SIZE         Max size (KB) before rotate (default=200KB, 0=off)
>         -b NUM          Number of rotated logs to keep (default=1,
> max=99, 0=purge)
>         -R HOST[:PORT]  Log to IP or hostname on PORT (default PORT=514/UDP)
>         -L              Log locally and via network logging (default
> is network only)
>         -C [size(KiB)]  Log to a circular buffer (read the buffer using logread)
> I am using following options when i fire syslogd daemon from rcS
> /etc/init.d/rcS
> klogd &
> syslogd -m 120 -S -s 250 -b 2 &
>  -m 160       Minutes between MARK lines (default=20, 0=of)
>  -S              Make logging output smaller.
>  -s 250KB    Max size (KB) before rotate (default=200KB, 0=off)
>  -b  2           Number of rotated logs to keep (default=1, max=99, 0=purge)
> tail -f should work if syslogd is updating the log file..........How
> do you test this , i mean what events do you use to generate the
> messages ?
> Rushi
> On 23/12/05, alfred hitch  wrote:
> > Hi,
> >
> > We have just started using busybox syslogd and tail etc ..
> > 2 Questions:
> >
> > 1) How to change the reap size after which syslogd shifts messages
> > from /var/log/messages to messages.old ? and then removes altogether ?
> > any option possible for runtime to syslogd
> >
> > 2) If I do a tail -f /var/log/messages and this file is "reap" ed in background.
> > I dont see any logs coming on screen, of course they are still going
> > to messages file. But, how to keep on getting these on screen also ..
> > some file handling desc. invalid issue ? any work arounds ?
> >
> > Regards,
> > Alfred
> > _______________________________________________
> > busybox mailing list
> > busybox at
> >
> >
busybox mailing list
busybox at

-------------- next part --------------
An HTML attachment was scrubbed...

More information about the busybox mailing list