Tiny Core Linux
Tiny Core Base => TCB Q&A Forum => Topic started by: GNUser on August 18, 2020, 02:08:21 PM
-
I use the syslog boot code. Today I noticed that /var/log/messages only holds about 1.5 hours' worth of messages.
Please, how do I increase the length of /var/log/messages on TCL? I'd like it to hold at least 24 hours' worth of messages.
-
Hi GNUser
When /var/log/messages fills up it gets saved to /var/log/messages.0. Then /var/log/messages starts getting filled up again.
-
Thanks, Rich. That helps some. Is there anything I can so that /var/log/messages can hold more lines before it "fills up"?
-
Hi GNUser
Or you can check:
syslogd --help
for additional options including log file size and # of rotated logs to keep.
-
Thanks, Rich. Yes, the -s flag is what I need. So I guess I need to remove the syslog boot code and start syslog with a boot job instead (to include the flag specifying bigger size)?
-
This is solved. As always, Rich, thank you for generously sharing your knowledge :)
-
Hi GNUser
Sorry, I was getting ready to head out when I caught your question.
... So I guess I need to remove the syslog boot code and start syslog with a boot job instead ...
Or you might be able to modify your boot code.
Looking through tc-config turns up the following:
rsyslog=* ) RSYSLOG=${i#*=}; SYSLOG=1 ;;
This sets $RSYSLOG equal to the string to the right of the = sign and sets $SYSLOG equal to 1.
syslog) SYSLOG=1 ;;
This is the syslog boot code. It just sets $SYSLOG equal to 1.
And finally, the section that handles the syslog request:
if [ -n "$SYSLOG" ]; then
[ -z "$RSYSLOG" ] || SOPTS=" -R $RSYSLOG -L "
/sbin/syslogd ${SOPTS} && echo "${GREEN}syslog started.${NORMAL}"
/sbin/klogd && echo "${GREEN}klog started."
The rsyslog boot code is there to allow sending log messages to IP_Address:Port. When it's not used, $RSYSLOG is an empty
string and $SOPTS evaluates to "-R -L". Without an address -R does nothing and -L tells it to log locally anyway. You should be
able to use this same mechanism to pass other options to syslogd. Try replacing the syslog boot code with:
rsyslog="-s 1000
for a log file size of 1000KB.
-
That's an interesting way to do it. Well, now I have an abundance of options! Thanks lot!
-
Hi GNUser
Although I am certain that it will work, please post your results if you happen to try it.
-
Small correction, an empty -R should cause an error. SOPTS is empty if RSYSLOG is not set.
-
Hi, Rich.
This causes udevd to complain about "unknown key" and syslog doesn't start at all:
rsyslog="-s 1000
This (two single quotes) causes syslog to start, but it only sees the -s flag and not the 1000 value:
rsyslog=''-s 1000
bruno@x200:~$ pgrep -fa syslog
350 /sbin/syslogd -R -s -L
All of these cause udevd to complain about "unknown key" and syslogd doesn't start:
rsyslog='''-s 1000'
rsyslog=''-s\ 1000
rsyslog=''-s1000
rsyslog="-s 1000"
-
Hi curaga
You are correct, I misinterpreted what was going on.
-
Hi GNUser
... This causes udevd to complain about "unknown key" and syslog doesn't start at all: ...
... This (two single quotes) causes syslog to start, but it only sees the -s flag and not the 1000 value: ...
I'm afraid you were the victim of my sloppiness. I forgot the closing quote.
Based on the information you provided, it may still be possible to abuse the rsyslog boot code like this:
rsyslog="0.0.0.0 -s 1000"
or this:
rsyslog="127.0.0.1 -s 1000"
-
Hi, Rich. Neither one of those works (udevd complains about "unknown key").
I'm happy with starting syslog with a boot job if you don't feel like hacking the boot code further.
-
Hi GNUser
I played with it for a while, but couldn't get it to work either.