WelcomeWelcome | FAQFAQ | DownloadsDownloads | WikiWiki

Author Topic: [Solved] how to increase length of /var/log/messages?  (Read 5047 times)

Offline GNUser

  • Wiki Author
  • Hero Member
  • *****
  • Posts: 1509
[Solved] how to increase length of /var/log/messages?
« on: August 18, 2020, 05:08:21 PM »
I use the  syslog  boot code. Today I noticed that  /var/log/messages  only holds about 1.5 hours' worth of messages.

Please, how do I increase the length of  /var/log/messages  on TCL? I'd like it to hold at least 24 hours' worth of messages.
« Last Edit: August 18, 2020, 09:27:59 PM by Rich »

Online Rich

  • Administrator
  • Hero Member
  • *****
  • Posts: 11623
Re: how to increase length of /var/log/messages?
« Reply #1 on: August 18, 2020, 05:13:21 PM »
Hi GNUser
When  /var/log/messages  fills up it gets saved to  /var/log/messages.0.  Then  /var/log/messages  starts getting filled up again.

Offline GNUser

  • Wiki Author
  • Hero Member
  • *****
  • Posts: 1509
Re: how to increase length of /var/log/messages?
« Reply #2 on: August 18, 2020, 05:15:39 PM »
Thanks, Rich. That helps some. Is there anything I can so that  /var/log/messages  can hold more lines before it "fills up"?

Online Rich

  • Administrator
  • Hero Member
  • *****
  • Posts: 11623
Re: how to increase length of /var/log/messages?
« Reply #3 on: August 18, 2020, 05:16:47 PM »
Hi GNUser
Or you can check:
Code: [Select]
syslogd --helpfor additional options including log file size and # of rotated logs to keep.

Offline GNUser

  • Wiki Author
  • Hero Member
  • *****
  • Posts: 1509
Re: how to increase length of /var/log/messages?
« Reply #4 on: August 18, 2020, 05:19:10 PM »
Thanks, Rich. Yes, the -s flag is what I need. So I guess I need to remove the  syslog  boot code and start syslog with a boot job instead (to include the flag specifying bigger size)?

Offline GNUser

  • Wiki Author
  • Hero Member
  • *****
  • Posts: 1509
Re: how to increase length of /var/log/messages?
« Reply #5 on: August 18, 2020, 06:23:28 PM »
This is solved. As always, Rich, thank you for generously sharing your knowledge :)

Online Rich

  • Administrator
  • Hero Member
  • *****
  • Posts: 11623
Re: how to increase length of /var/log/messages?
« Reply #6 on: August 18, 2020, 09:14:06 PM »
Hi GNUser
Sorry, I was getting ready to head out when I caught your question.

... So I guess I need to remove the  syslog  boot code and start syslog with a boot job instead ...

Or you might be able to modify your boot code.

Looking through  tc-config  turns up the following:
Code: [Select]
rsyslog=* ) RSYSLOG=${i#*=}; SYSLOG=1 ;;This sets  $RSYSLOG  equal to the string to the right of the  =  sign and sets  $SYSLOG  equal to 1.

Code: [Select]
syslog) SYSLOG=1 ;;This is the  syslog  boot code. It just sets  $SYSLOG  equal to 1.

And finally, the section that handles the  syslog  request:
Code: [Select]
if [ -n "$SYSLOG" ]; then
[ -z "$RSYSLOG" ] || SOPTS=" -R $RSYSLOG -L "
/sbin/syslogd ${SOPTS} && echo "${GREEN}syslog started.${NORMAL}"
/sbin/klogd && echo "${GREEN}klog started."

The  rsyslog  boot code is there to allow sending log messages to  IP_Address:Port.   When it's not used,  $RSYSLOG  is an empty
string and  $SOPTS  evaluates to  "-R -L".  Without an address  -R  does nothing and  -L  tells it to log locally anyway. You should be
able to use this same mechanism to pass other options to  syslogd.  Try replacing the  syslog  boot code with:
Code: [Select]
rsyslog="-s 1000for a log file size of 1000KB.

Offline GNUser

  • Wiki Author
  • Hero Member
  • *****
  • Posts: 1509
Re: how to increase length of /var/log/messages?
« Reply #7 on: August 18, 2020, 09:21:40 PM »
That's an interesting way to do it. Well, now I have an abundance of options! Thanks lot!

Online Rich

  • Administrator
  • Hero Member
  • *****
  • Posts: 11623
Re: [Solved] how to increase length of /var/log/messages?
« Reply #8 on: August 18, 2020, 09:31:51 PM »
Hi GNUser
Although I am certain that it will work, please post your results if you happen to try it.

Offline curaga

  • Administrator
  • Hero Member
  • *****
  • Posts: 11044
Re: [Solved] how to increase length of /var/log/messages?
« Reply #9 on: August 19, 2020, 03:20:46 AM »
Small correction, an empty -R should cause an error. SOPTS is empty if RSYSLOG is not set.
The only barriers that can stop you are the ones you create yourself.

Offline GNUser

  • Wiki Author
  • Hero Member
  • *****
  • Posts: 1509
Re: [Solved] how to increase length of /var/log/messages?
« Reply #10 on: August 19, 2020, 07:41:34 AM »
Hi, Rich.

This causes udevd to complain about "unknown key" and syslog doesn't start at all:
Code: [Select]
rsyslog="-s 1000
This (two single quotes) causes syslog to start, but it only sees the  -s  flag and not the 1000 value:
Code: [Select]
rsyslog=''-s 1000

bruno@x200:~$ pgrep -fa syslog
350 /sbin/syslogd -R -s -L

All of these cause udevd to complain about "unknown key" and syslogd doesn't start:
Code: [Select]
rsyslog='''-s 1000'
rsyslog=''-s\ 1000
rsyslog=''-s1000
rsyslog="-s 1000"

Online Rich

  • Administrator
  • Hero Member
  • *****
  • Posts: 11623
Re: [Solved] how to increase length of /var/log/messages?
« Reply #11 on: August 19, 2020, 09:14:14 AM »
Hi curaga
You are correct, I misinterpreted what was going on.

Online Rich

  • Administrator
  • Hero Member
  • *****
  • Posts: 11623
Re: [Solved] how to increase length of /var/log/messages?
« Reply #12 on: August 19, 2020, 09:28:05 AM »
Hi GNUser
... This causes udevd to complain about "unknown key" and syslog doesn't start at all: ...

 ... This (two single quotes) causes syslog to start, but it only sees the  -s  flag and not the 1000 value: ...
I'm afraid you were the victim of my sloppiness. I forgot the closing quote.

Based on the information you provided, it may still be possible to abuse the  rsyslog  boot code like this:
Code: [Select]
rsyslog="0.0.0.0 -s 1000"or this:
Code: [Select]
rsyslog="127.0.0.1 -s 1000"

Offline GNUser

  • Wiki Author
  • Hero Member
  • *****
  • Posts: 1509
Re: [Solved] how to increase length of /var/log/messages?
« Reply #13 on: August 19, 2020, 11:30:29 AM »
Hi, Rich. Neither one of those works (udevd complains about "unknown key").
I'm happy with starting syslog with a boot job if you don't feel like hacking the boot code further.

Online Rich

  • Administrator
  • Hero Member
  • *****
  • Posts: 11623
Re: [Solved] how to increase length of /var/log/messages?
« Reply #14 on: August 20, 2020, 12:44:35 AM »
Hi GNUser
I played with it for a while, but couldn't get it to work either.