In Ubuntu, Fedora and other systems I’ve seen rsyslog running on, to see the console messages you have to have physical access to the server usually through a KVM or IP-KVM setup. Kernel messages are sent to /dev/console while mail, crit, debug, and others get sent to files.
to tail
Any of these message can be monitored remotely since they’re output as files by using the tail utility. Executing tail with the –follow switch in a shell allows you to watch the ouput as it is written to a file, in real time. So all you have to do is write kern messages to a file too…
$ sudo tail -n 88 -f /var/log/messages
or not to tail
But why tail a file when you could just send the kernel messages straight to a user account name. Instead of specifying a path to a file within rsylog.conf, add a user name instead or in addition to a file path.
kern /dev/console,rootninja
Now whenever i’m logged in as rootninja it’s just like i’m right there at the console.
log spillage
If you’re spewing out logs faster than rsyslog can handle and you’re comfortable with the possibility of losing data if you get a system crash between the write and the next disk sync, you can begin each file entry with a minus sign to omit syncing and squeeze out that last bit of performance. I wouldn’t suggest this unless you know you need it. When debugging talky apps, this would be better than just writing out your own files. I only mention this because I haven’t convinced any of the developers I work with to write to syslog for any of the apps they’re writing, even when these apps are interrelated… but that’s a whole new story!
advanced stuff
I haven’t even scratched the surface. I like being able to use templates for output and to send logs to remote IP’s, but other features of rsyslog are beyond anything that I have needed. You can use z0 through z9 for compressing messages sent over TCP. Rsyslog will compress any messages over 60 bytes long. I think the CPU overhead is probably a bad trade-off for just a minor improvement. It’s usually safe to try out new settings since misconfigurations in rsyslog.conf are usually ignored (such as using templates before defining them), so your configurations probably won’t fall down go boom, but that also makes it less obvious to know if things are working like you want.
From syslog’s website: http://www.rsyslog.com/
Rsyslog is an enhanced multi-threaded syslogd with a focus on security and reliability. Among others, it offers support for on-demand disk buffering, reliable syslog over TCP, SSL, TLS and RELP, writing to databases (MySQL, PostgreSQL, Oracle, and many more), email alerting, fully configurable output formats (including high-precision timestamps), the ability to filter on any part of the syslog message, on-the-wire message compression, and the ability to convert text files to syslog. It is a drop-in replacement for stock syslogd and able to work with the same configuration file syntax.
Go here if you want to join the rsyslog mailing list: http://lists.adiscon.net/mailman/listinfo/rsyslog
Uncategorized kernel, messaes, performance, remote, rsyslog, shell, syslog
Recent Comments