[systemd-devel] syslogs in /proc/kmsg

[Albert Strasheim]

Hello

On Tue, Sep 6, 2011 at 12:52 AM, Lennart Poettering
<lennart at poettering.net> wrote:
> On Mon, 05.09.11 12:25, Albert Strasheim (fullung at gmail.com) wrote:
>> Hello all
>> Also, it doesn't seem as if the first application logs end up
>> /var/log/messages though.
>> Should I be seeing these first application logs in /var/log/messages?
>> Also, is there any way to avoid the application logs in /proc/kmsg (to
>> avoid the overflow)? I guess I could add After=rsyslog.service to all
>> my services, but that doesn't seem right.
> Basically, early boot messages go into kmsg now. Previously they went to
> /dev/null. The quicker rsyslog gets started the earlier messages will
> be written directly to syslog.

This is probably more of a question for the rsyslog list, but why
isn't rsyslog reprocessing all the stuff in kmsg according to its
rules and putting it in files? It seems like it processes the kernel
messages, but not application messages.

I had the following scenario: a bunch of our services start up with
rsyslog. There was one case where the service would crash if started
early in the boot process. This crash log only ended up in kmsg, and
not in the files I configured in rsyslog for that service.

I understand that those logs have to go to kmsg initially, but I see
it as a temporary buffer until they can be handled properly.

> If the log buffer runs full too quickly, then it might be an optoin to
> fix the apps in question to log less (for example, systemd logs a lot in
> debug mode. Hence if you currently run it in debug mode it might be an
> idea to turn off debug mode again), or to increase the log buffer size
> with "log_buf_len=2M" or so on the kernel cmdline.

Thanks, I'll start with that.

Regards

Albert