Hello On Tue, Sep 6, 2011 at 12:52 AM, Lennart Poettering <[email protected]> wrote: > On Mon, 05.09.11 12:25, Albert Strasheim ([email protected]) wrote: >> Hello all >> Also, it doesn't seem as if the first application logs end up >> /var/log/messages though. >> Should I be seeing these first application logs in /var/log/messages? >> Also, is there any way to avoid the application logs in /proc/kmsg (to >> avoid the overflow)? I guess I could add After=rsyslog.service to all >> my services, but that doesn't seem right. > Basically, early boot messages go into kmsg now. Previously they went to > /dev/null. The quicker rsyslog gets started the earlier messages will > be written directly to syslog.
This is probably more of a question for the rsyslog list, but why isn't rsyslog reprocessing all the stuff in kmsg according to its rules and putting it in files? It seems like it processes the kernel messages, but not application messages. I had the following scenario: a bunch of our services start up with rsyslog. There was one case where the service would crash if started early in the boot process. This crash log only ended up in kmsg, and not in the files I configured in rsyslog for that service. I understand that those logs have to go to kmsg initially, but I see it as a temporary buffer until they can be handled properly. > If the log buffer runs full too quickly, then it might be an optoin to > fix the apps in question to log less (for example, systemd logs a lot in > debug mode. Hence if you currently run it in debug mode it might be an > idea to turn off debug mode again), or to increase the log buffer size > with "log_buf_len=2M" or so on the kernel cmdline. Thanks, I'll start with that. Regards Albert _______________________________________________ systemd-devel mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/systemd-devel
