[Solved] how to increase length of /var/log/messages?

[GNUser]

I use the  syslog  boot code. Today I noticed that  /var/log/messages  only holds about 1.5 hours' worth of messages.

Please, how do I increase the length of  /var/log/messages  on TCL? I'd like it to hold at least 24 hours' worth of messages.

[Rich]

Hi GNUser
When  /var/log/messages  fills up it gets saved to  /var/log/messages.0.  Then  /var/log/messages  starts getting filled up again.

[GNUser]

Thanks, Rich. That helps some. Is there anything I can so that  /var/log/messages  can hold more lines before it "fills up"?

[Rich]

Hi GNUser
Or you can check:

Code: [Select]

syslogd --helpfor additional options including log file size and # of rotated logs to keep.

[GNUser]

Thanks, Rich. Yes, the -s flag is what I need. So I guess I need to remove the  syslog  boot code and start syslog with a boot job instead (to include the flag specifying bigger size)?

[GNUser]

This is solved. As always, Rich, thank you for generously sharing your knowledge

[Rich]

Hi GNUser
Sorry, I was getting ready to head out when I caught your question.

... So I guess I need to remove the  syslog  boot code and start syslog with a boot job instead ...

Or you might be able to modify your boot code.

Looking through  tc-config  turns up the following:

Code: [Select]

rsyslog=* ) RSYSLOG=${i#*=}; SYSLOG=1 ;;This sets  $RSYSLOG  equal to the string to the right of the  =  sign and sets  $SYSLOG  equal to 1.

Code: [Select]

syslog) SYSLOG=1 ;;This is the  syslog  boot code. It just sets  $SYSLOG  equal to 1.

And finally, the section that handles the  syslog  request:

Code: [Select]

if [ -n "$SYSLOG" ]; then
[ -z "$RSYSLOG" ] || SOPTS=" -R $RSYSLOG -L "
/sbin/syslogd ${SOPTS} && echo "${GREEN}syslog started.${NORMAL}"
/sbin/klogd && echo "${GREEN}klog started."
The  rsyslog  boot code is there to allow sending log messages to  IP_Address:Port.   When it's not used,  $RSYSLOG  is an empty
string and  $SOPTS  evaluates to  "-R -L".  Without an address  -R  does nothing and  -L  tells it to log locally anyway. You should be
able to use this same mechanism to pass other options to  syslogd.  Try replacing the  syslog  boot code with:

Code: [Select]

rsyslog="-s 1000for a log file size of 1000KB.

[GNUser]

That's an interesting way to do it. Well, now I have an abundance of options! Thanks lot!

[Rich]

Hi GNUser
Although I am certain that it will work, please post your results if you happen to try it.

[curaga]

Small correction, an empty -R should cause an error. SOPTS is empty if RSYSLOG is not set.

[GNUser]

Hi, Rich.

This causes udevd to complain about "unknown key" and syslog doesn't start at all:

Code: [Select]

rsyslog="-s 1000
This (two single quotes) causes syslog to start, but it only sees the  -s  flag and not the 1000 value:

Code: [Select]

rsyslog=''-s 1000

bruno@x200:~$ pgrep -fa syslog
350 /sbin/syslogd -R -s -L
All of these cause udevd to complain about "unknown key" and syslogd doesn't start:

Code: [Select]

rsyslog='''-s 1000'
rsyslog=''-s\ 1000
rsyslog=''-s1000
rsyslog="-s 1000"

[Rich]

Hi curaga
You are correct, I misinterpreted what was going on.

[Rich]

Hi GNUser

... This causes udevd to complain about "unknown key" and syslog doesn't start at all: ...

 ... This (two single quotes) causes syslog to start, but it only sees the  -s  flag and not the 1000 value: ...

I'm afraid you were the victim of my sloppiness. I forgot the closing quote.

Based on the information you provided, it may still be possible to abuse the  rsyslog  boot code like this:

Code: [Select]

rsyslog="0.0.0.0 -s 1000"or this:

Code: [Select]

rsyslog="127.0.0.1 -s 1000"

[GNUser]

Hi, Rich. Neither one of those works (udevd complains about "unknown key").
I'm happy with starting syslog with a boot job if you don't feel like hacking the boot code further.

[Rich]

Hi GNUser
I played with it for a while, but couldn't get it to work either.