Options for logging console messages

[Furnish, Trever G]

Your server should not hang during shutdown as a result of having kernel
logging pointed to /var/log/console in /etc/syslog.conf.  Something else
is going on.

(Also, if you're going to log to /var/log/console, don't forget to add
that file to /etc/logrotate.d/syslog, so that you don't fill up /var in
the future.)

If a storage hang is your problem, it's possible that after boot you
won't have all log messages.  You didn't mention what other systems are
nearby, but you can also send your syslog messages over the network to a
remote syslog server (ie another machine nearby on the network), so that
you have a second copy on separate hardware.  The machine receiving the
logs from the network can be Linux or Windows (or anything else that
accepts syslog over the wire).  On RHEL you'd want to add "-r" to the
options for syslogd in /etc/sysconfig/syslog, and open the syslog port
in iptables if you've got it locked down.  (Preferably open it only to
the system you're troubleshooting.)  On Windows you can use Kiwi Syslog
for free.

--
Trever


> -----Original Message-----
> From: redhat-list-bounces at redhat.com [mailto:redhat-list-
> bounces at redhat.com] On Behalf Of Jeff Boyce
> Sent: Monday, March 02, 2009 1:19 PM
> To: redhat-list at redhat.com
> Subject: Options for logging console messages
> 
> Background / problem description.
> I administer a RHEL3 U9 file server for a small business.  While I was
> out
> of town recently the server locked up and the staff rebooted it and
> everything came back up ok.  After I returned to the office I got a
> debriefing of what happened and had a chance to look through the log
> files
> to find any indication of what might of happened.  From talking to the
> person that rebooted the system, they stated that there were messages
> on the
> console that referred to a possible problem with the scsi card.  I
> found no
> indication of anything like this in any of the log files.  Syslog was
> sending kernel messages to /dev/console, so to gather information if
> the
> problem re-occurs I now have syslog also sending kernel messages to
> /var/log/console.  However, conducting some unrelated maintenance on
> the
> server this weekend, the server hung-up on shutting down the first
> time, it
> just paused indefinitely at unmounting the filesystems.  After about
10
> minutes I hit the power button to do a hard shutdown.  It rebooted
just
> fine
> again, and suspecting that the problem was logging to a file while
> shutting
> down, I stopped the logging to the /var/log/console file and rebooted.
> The
> server shutdown without the long pause and rebooted just fine.
> 
> Objective.
> I want to keep logging kernel messages to a file in order to be able
to
> have
> documentation of a problem like the recent one.  But I also do not
want
> to
> have the server hang-up while shutting down, and I would like to not
> have to
> remember to modify and restart my syslog configuration file prior to
> rebooting the system.  Can anyone offer any suggestions for logging
the
> kernel messages without having it interfere with the shutdown process.
> Or,
> am I way off base here and have mis-diagnosed what happened?  Thanks.
> 
> Jeff Boyce
> www.meridianenv.com
> 
> --
> redhat-list mailing list
> unsubscribe mailto:redhat-list-request at redhat.com?subject=unsubscribe
> https://www.redhat.com/mailman/listinfo/redhat-list