I've been using syslogd/klogd for years on linux systems and it seems to work as described in its docs, no issues. Unfortunately, it isn't being maintained and I now need ipv6 capability. Hence, syslog-ng. I like the straightforward configuration file structure, and with its emerging ipv6 capability, it seems like the future of open source syslogging, but I'm running into a little trouble making a seamless transition from syslogd/klogd. Apart from the problem I described in my previous post concerning the hostname being dropped from messages forwarded over udp6 to a loghost, I'm also running into a little difficulty with kernel message handling. It seems that the internal syslog-ng kernel message logging lacks a feature present in klogd that allows inhibiting kernel messages from appearing on the console, unless they are above a command line settable priority level. With syslog-ng, I seem to be getting all of the kernel messages coming out on /dev/console. I'm in an embedded environment using the mtd flash kernel drivers, which generate a lot of info level messages while erasing and writing to raw flash devices. klogd allows me to inhibit these quite nicely. Am I correct that syslog-ng lacks this capability, or just that I don't know how to configure it? As a workaround, I tried using klogd with syslog-ng. I did turn off the syslog-ng source for /proc/kmsg. Now I don't see kernel messages on my console, but I don't get any kernel message logging either. Again, should this work? I don't see that there should be any special source definition in syslog-ng.conf for this to work. Thanks, Bruce.
Bruce Penrod wrote:
Apart from the problem I described in my previous post concerning the hostname being dropped from messages forwarded over udp6 to a loghost, I'm also running into a little difficulty with kernel message handling. It seems that the internal syslog-ng kernel message logging lacks a feature present in klogd that allows inhibiting kernel messages from appearing on the console, unless they are above a command line settable priority level. With syslog-ng, I seem to be getting all of the kernel messages coming out on /dev/console. I'm in an embedded environment using the mtd flash kernel drivers, which generate a lot of info level messages while erasing and writing to raw flash devices. klogd allows me to inhibit these quite nicely. Am I correct that syslog-ng lacks this capability, or just that I don't know how to configure it?
Separate the kernel messages into a new source, and use the usertty() destination to log only the appropriate messages to the console. If you want to turn off the logging of messages to the console use dmesg, or set up /proc/sys/kernel/printk manually. That's what klogd does. -- Sandor Geller wildy@balabit.hu
On Fri, 2006-08-11 at 16:11 -0700, Bruce Penrod wrote:
As a workaround, I tried using klogd with syslog-ng. I did turn off the syslog-ng source for /proc/kmsg. Now I don't see kernel messages on my console, but I don't get any kernel message logging either. Again, should this work? I don't see that there should be any special source definition in syslog-ng.conf for this to work.
In addition to Sandor's response, I'd like to add that this combination should work, however klogd uses its own syslog() implementation instead of using the one in libc, and it does not support unix-stream() /dev/log, only unix-dgram(). That's probably the reason why it does not work. -- Bazsi
participants (3)
-
Balazs Scheidler
-
Bruce Penrod
-
Sandor Geller