RE: Options for logging console messages



Your server should not hang during shutdown as a result of having kernel
logging pointed to /var/log/console in /etc/syslog.conf. Something else
is going on.

(Also, if you're going to log to /var/log/console, don't forget to add
that file to /etc/logrotate.d/syslog, so that you don't fill up /var in
the future.)

If a storage hang is your problem, it's possible that after boot you
won't have all log messages. You didn't mention what other systems are
nearby, but you can also send your syslog messages over the network to a
remote syslog server (ie another machine nearby on the network), so that
you have a second copy on separate hardware. The machine receiving the
logs from the network can be Linux or Windows (or anything else that
accepts syslog over the wire). On RHEL you'd want to add "-r" to the
options for syslogd in /etc/sysconfig/syslog, and open the syslog port
in iptables if you've got it locked down. (Preferably open it only to
the system you're troubleshooting.) On Windows you can use Kiwi Syslog
for free.

--
Trever


-----Original Message-----
From: redhat-list-bounces@xxxxxxxxxx [mailto:redhat-list-
bounces@xxxxxxxxxx] On Behalf Of Jeff Boyce
Sent: Monday, March 02, 2009 1:19 PM
To: redhat-list@xxxxxxxxxx
Subject: Options for logging console messages

Background / problem description.
I administer a RHEL3 U9 file server for a small business. While I was
out
of town recently the server locked up and the staff rebooted it and
everything came back up ok. After I returned to the office I got a
debriefing of what happened and had a chance to look through the log
files
to find any indication of what might of happened. From talking to the
person that rebooted the system, they stated that there were messages
on the
console that referred to a possible problem with the scsi card. I
found no
indication of anything like this in any of the log files. Syslog was
sending kernel messages to /dev/console, so to gather information if
the
problem re-occurs I now have syslog also sending kernel messages to
/var/log/console. However, conducting some unrelated maintenance on
the
server this weekend, the server hung-up on shutting down the first
time, it
just paused indefinitely at unmounting the filesystems. After about
10
minutes I hit the power button to do a hard shutdown. It rebooted
just
fine
again, and suspecting that the problem was logging to a file while
shutting
down, I stopped the logging to the /var/log/console file and rebooted.
The
server shutdown without the long pause and rebooted just fine.

Objective.
I want to keep logging kernel messages to a file in order to be able
to
have
documentation of a problem like the recent one. But I also do not
want
to
have the server hang-up while shutting down, and I would like to not
have to
remember to modify and restart my syslog configuration file prior to
rebooting the system. Can anyone offer any suggestions for logging
the
kernel messages without having it interfere with the shutdown process.
Or,
am I way off base here and have mis-diagnosed what happened? Thanks.

Jeff Boyce
www.meridianenv.com

--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list

--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list



Relevant Pages

  • Re: Need to implemet Syslog server
    ... >On my network I need to implement a Syslog server ... Pretty much everything but Windows will ... likely talk to syslog if told to, ... A great many other managed network devices support syslogging, ...
    (Security-Basics)
  • Re: IPTABLES logging (was: NTP, ntpdate and ISP-based firewall)
    ... > I tell anything kernel* level of syslog to be logged in a file ... > unused syslog level perhaps. ... This is the firewall on the mail server itself; ...
    (Fedora)
  • Re: journal commit I/O error
    ... >I am running Debian Sarge with kernel 2.6.6. ... The server is mainly used for DB server, ... Try rebooting the machine, ...
    (comp.os.linux.misc)
  • [HPADM] SUMMARY: syslog redirection
    ... server is down, entries will be lost. ... Syslog sends over UDP on a "broadcast and forget" concept. ... information that is subject to United States laws and regulations. ... I'm being asked to route syslog messages to a central server. ...
    (HP-UX-Admin)
  • RE: Syslog Server on Debian Etch
    ... Syslog was working fine on the clients, I had it installed to a diff ... Is anyone else monitoring Juniper Netscreen firewalls? ... Syslog Server on Debian Etch ...
    (Debian-User)