I have a Yocto build that utilises syslog and logrotate. I have configured my syslog to place any DEBUG messages into a log stored in a hidden folder. This will allow my team to retrieve in field logs without exposing them to the end user.
Syslog logs anything not DEBUG to /var/log as expected. The DEBUG logs go to /home/root/.hidden_logs.
My issue is, if the .hidden_logs folder is deleted, syslog stops logging DEBUG messages. When I run cat /etc/passwd I do not see a syslog user. Is there a way to tell syslog to create /home/root/.hidden_logs if it does not already exist? If not, my plan is to have my application check if the folder exists on boot, if not, create it.
Related
How to manage catalina.log file, if file is reached a particular size (GB) then copy all logs into another file so i will check logs with a new stable file.
please give me solutions to manage logs file.
I am running an ELK-Stack as a central syslogserver and I set up rsyslog to send logfiles, which are not logging into /var/lib/messages by default, to it.
The setup is working very well but since I made the configuration the external logfiles actually show up in the messages file, which is blowing it out of proportion and makes debugging normal systemlogs difficult.
I want the logs to be send to the syslogserver but not into the messages file.
This is my current configuration:
111-elk-syslog.conf:
*.* ##IP_OF_THE_SYSLOGSERVER:514
101-external-log.conf
$ModLoad imfile
$InputFileName PATH_TO_LOGFILE
$InputFileTag FILE_TAG
$InputFileStateFile FILE_TAG
$InputFileFacility local3
$InputRunFileMonitor
I know, using filebeat, I could circumvent this but rsyslog is working very well in my enviroment and this application is the only one logging so much, that this is an actual problem.
I don't understand in detail your setup, but it may help to know that in general in rsyslogd if you don't want further handling of a message that you have matched, you simply repeat the filter on the next line by using &, and the action stop. For example, you might try
*.* ##IP_OF_THE_SYSLOGSERVER:514
& stop
Let's say I connect to the Rundeck UI at <server>:4440. I construct a job, schedule it to run every 15 min., then wait a few days. Then, I want to do some analysis of the Job runlogs, gathering some statistics from logging statements I added. The problem is... where are the logs? Are they somewhere on <server>? Or on some other node (if so, what server and what file path).
I know I can download the logs, but they're big, so I'd rather do the statistics gathering close to where the log data live.
The execution logs outputs are stored in the location specified in your framework.properties file. By default:
framework.logs.dir=$RDECK_BASE/var/logs
"Directory for log files written by core services and Rundeck Server’s Job executions"
ref. Configuration File reference.
Hope it helps!
Why is it that when I type 'mongod -f \pluralsight\mongod.conf' (path of my conf file) in terminal, I get the following flush spam in my log file? :
Is this normal?
Here is my configuration file in case you need it.
I recently installed MongoDB and I just don't want a file that is logging that my storage is being flushed, seems like poor data management. I'm not sure what is available to me to address this, or if this is normal and permissible, or if maybe there's something I'm doing wrong when I started this project.
I figured it out, it's because in my mongod.conf file I had the verbose property set to "verbose=vvvvvv". I set it to "verbose=vvv" so it shows less info on logged.
On Centos 6.2, trying to get the kernel log redirected to the serial console, I came across an issue where agetty seems to be respawning every few keypresses.
That is, I get a login prompt in the middle of typing (after logging in).
In order to investigate the issue further, I'm looking for the location of agetty logs, but to no avail. Where and how can I see log messages for respawned agetty process?
The "diagnostics" section of the "agetty" command manpage states:
Depending on how the program was configured, all diagnostics are written to
the console device or reported via the syslog(3) facility. Error messages are
produced if the port argument does not specify a terminal device; if there is
no utmp entry for the current process (System V only); and so on.
The syslog facility by default writes the "/var/log/messages" file, but it can be configured to write another file by editing its configuration file "/etc/syslog.conf".
Finally, if the error you get is "respawning too fast", you should check your "/etc/inittab" file, as described here.