meta data for this page

Logging

Update for 20.7

There is a option to disable legacy circular logging: Local (non circular) logs And code change: Syslog: optionally disable legacy (clog) logging

Pre 20.7

DO NOT INCRESE CIRCULAR LOG SIZES! SYSLOG CLOG support is implemented using mmap-ed files. So with log file size 100MB it makes HDD 100% busy and make system not responsive.

  • syslogd is used as local system logger
    • /usr/local/sbin/syslogd -s -c -c -P /var/run/syslog.pid -p /var/run/legacy_log -S /var/run/legacy_logpriv -k -s -s -f /var/etc/syslog.conf
      • -s secure mode - do not log from remote machines
      • -c -c disable compression of repeated lines for all instances
      • -S additional socket for privileged applications
      • -k do not translate kern to user
      • -s -s no network - no remote logging
  • syslog-ng is spawned to forward logs to remote hosts

Circular log files:

  • There is not log rotation. To keep longer log history, increase log size to i.e. 100M. There are aroung 22 log files, so 22*100M gives 2.2GB occupied space.
  • to keep log files at constant size, syslogd is compiled with clog support. Circular log support for FreeBSD syslogd
  • Config file syslog.conf contain special % marker to signal that log file is a circular log file
  • Each log file is initialized to maximum size by tool clog.
  • At the end file, special information structure is stored for CLOG.
# tail z dnsmasq.log file
clog -f /var/log/dnsmasq.log