Tiny Core Base > TCB Q&A Forum
Rsyslog not working
Stefann:
It works!!!
either my 1st edit fixed it:
--- Code: ---$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$ModLoad imklog
$ModLoad imuxsock
--- End code ---
Or my 2nd edit fixed it:
--- Code: ---$WorkDirectory /var/log/work
--- End code ---
I feel that it already worked after the 1st edit, but I did not notice as during the debugging I had set the logging to my home (to avoid authorization issues) but was checking /var/log for activity which was not there.
Anyway...
I did find some guidance on internet:
--- Code: ---$ModLoad imuxsock
in order to receive log messages from local system processes. This
config directive should only left out if you know exactly what you
are doing.
--- End code ---
--- Code: ---$WorkDirectory /var/log/work
If no working directory set it defaults to root which will not work due to lacking authorization
--- End code ---
All in all,
Thanks Andy for sharing your config.
It did help narrow down "what directives are really essential".
I did notice that you had the working directory set that I did not. That got me google on working directory on which I found that to be an essential directive.
And I got some confirmation that the other directives were ok.
andyj:
You may want to consider using separate (and probably persistent) file systems for your working directory and logs so you don't fill up RAM. Maybe something like this:
--- Code: ---# rsyslog Templates
template (name="DynFile" type="string" string="/srv/syslog2/log/syslog-%$now-utc%.log")
template (name="DynStat" type="string" string="/srv/syslog2/log/pstats-%$now-utc%.log")
# rsyslog RuleSets
action(type="omfile" dynafile="DynFile")
if $syslogtag contains 'rsyslogd-pstats' then {
action(type="omfile" queue.type="linkedlist" queue.discardmark="980" name="pstats" dynafile="DynStat")
stop
}
--- End code ---
I have my persistent file systems mounted under /srv mostly to avoid conflicts with /mnt, but I'm using a VM so adding file systems for additional space is a fairly simple task.
Stefann:
Thanks!
This is how I now implemented it:
- only log my own application that uses local1 as identifier
- slow log for notice & info messages. This log has few lines per hour and provides a multi-day log
- error log for debug messages. This log has multiple lines per second. Typically one needs a few minutes of logging to debug something
(note, application only sends debugging information when that is enabled)
Andyj..... GOOD POINT......
I now realise that log rotation is not standard for Rsyslog. It can be done with the conf file. Not overly difficult but "adding complexity"
Boy..... I actually only did need the standard syslog to have a conf file... conf file however is not included with tiny core standard busy box version.
Will need to make the rotation before I use the debuggging
Note, I doNOT want to write to persistent filesystem. That is a FCcard that I want to write only 1x/day. That's actually what I love about tiny core.
But that's ok.
the "slow log" is really just a few lines per hour. it will take a m month before that becomes a megabyte
The "fast log" will definitely need a rotate. I don't need more history than 15mins or so, but it shall not eat my ram.
--- Code: ---$WorkDirectory /var/log/work
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$ModLoad imklog
$ModLoad imuxsock
$template MyFormat,"%timegenerated:1:19% %msg:::drop-last-lf%\n"
local1.=notice;local1.=info /var/log/slowlog.txt;MyFormat
local1.=debug /var/log/errorlog.txt;MyFormat
--- End code ---
andyj:
I can add a sample conf file the next time I update the extension. The problem with sample conf files though is that they cause other problems because people think that is all they need, then complain when that does not do what they want either.
Stefann:
Hi,
I think I have rotation added:
--- Code: ---$WorkDirectory /var/log/work
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
$ModLoad imklog
$ModLoad imuxsock
$template MyFormat,"%timegenerated:1:19% %msg:::drop-last-lf%\n"
#example (got that from the internet)
# $outchannel log_rotation,/var/log/log_rotation.log, 52428800,/home/me/./log_rotation_script
# activate the channel and log everything to it
# *.* :omfile:$log_rotation
#
# /home/me/log_rotation_script:
# mv -f /var/log/log_rotation.log /var/log/log_rotation.log.1
#max 100k debugfile = 1000 lines x 100chars
$outchannel debug_log,/var/log/errorlog.txt, 100000,/var/log/./rotate_debug
local1.=notice;local1.=info /var/log/slowlog.txt;MyFormat
# original before rotation:
# local1.=debug /var/log/errorlog.txt;MyFormat
# new with rotation:
local1.=debug :omfile:$debug_log;MyFormat
--- End code ---
with /var/log/rotate_debug
--- Code: ---tail -n 500 errorlog.txt > error.tmp
mv -f error.tmp errorlog.txt
--- End code ---
(so I'm not getting a 2nd file but when file gets to max I only keep the last 500 lines and let it grow again)
the "slow part" sure works.
full testing the debug part will become next weekend.
Its live running
But I have fast debug-data disabled in the application.
That will need testing "under attention" which will become next weekend (I'm in Europe and day is ending)
And thanks again from being able to pull me from my "dead spot"
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version