syslog output not in chronological order, mandriva 2005, initng not installed
MandrivaThis Forum is for the discussion of Mandriva (Mandrake) Linux.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Distribution: Mandriva mostly, vector 5.1, tried many.Suse gone from HD because bad Novell/Zinblows agreement
Posts: 1,606
Rep:
syslog output not in chronological order, mandriva 2005, initng not installed
The syslog entries are not all in chronological order (Example below).
It is like logging was interleaved sometimes.
Cannot make sense of why (conf files and man pages), and no luck with google.
Thanks for any suggestion. More info about config after.
# cat /usr/src/linux-2.6.11-13mdk/.config | grep BUF_S
CONFIG_LOG_BUF_SHIFT=14
2.6.11-13mdkcustom, but it did that with the previous stock kernel as well.
Cannot say when problem started, month and month ago before I knew much
about linux. Never installed initng BTW.
Also I think it was still doing it with 2.6.11-13mdkcustom when buffer was 128 Ko.
Running a sempron 32 bits PC
# cat /etc/syslog.conf
Code:
# Various entry
auth,authpriv.* /var/log/auth.log
*.*;auth,authpriv.none -/var/log/syslog
user.* -/var/log/user.log
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;;news.none;authpriv.none -/var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Mail logging
mail.=debug;mail.=info;mail.=notice -/var/log/mail/info
mail.=warn -/var/log/mail/warnings
mail.err -/var/log/mail/errors
# Cron logging
cron.=debug;cron.=info;cron.=notice -/var/log/cron/info
cron.=warn -/var/log/cron/warnings
cron.err -/var/log/cron/errors
# Kernel logging
kern.=debug;kern.=info;kern.=notice -/var/log/kernel/info
kern.=warn -/var/log/kernel/warnings
kern.err /var/log/kernel/errors
# Lpr logging
lpr.=debug;lpr.=info;lpr.=notice -/var/log/lpr/info
lpr.=warn -/var/log/lpr/warnings
lpr.err -/var/log/lpr/errors
# Daemons logging
daemon.=debug;daemon.=info;daemon.=notice -/var/log/daemons/info
daemon.=warn -/var/log/daemons/warnings
daemon.err -/var/log/daemons/errors
# Everybody gets emergency messages
*.emerg *
# Save boot messages also to boot.log
local7.* -/var/log/boot.log
# Explanations from Mandrake Linux configuration tools
local1.* -/var/log/explanations
*.* /dev/tty12
# Sample syslog.conf entries
*.info;local4.none;local4.warn /var/log/messages
local4.info -/var/log/sensors
local4.alert /dev/console
local4.alert *
The chronological problem was happening before, when I was using the stock kernel linux-2.6.11-6mdk.
I thought it might be because of swatch, but swatch is started by .kde/Autostart/myscript.sh
konsole --noclose -T realtime_syslog -e sudo swatch -c /etc/swatchrc --tail-file=/var/log/syslog
logrotate is the default config
Code:
# cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
compress
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own lastlog, wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0600 root utmp
rotate 1
}
/var/log/lastlog {
monthly
rotate 1
}
Distribution: Mandriva mostly, vector 5.1, tried many.Suse gone from HD because bad Novell/Zinblows agreement
Posts: 1,606
Original Poster
Rep:
The last time with an hour difference is
Jul 23 16:51:59 localhost rc.sysinit: Configuring kernel parameters: succeeded.
Then the clock is set correctly by
Jul 23 15:51:58 localhost rc.sysinit: Setting clock (localtime): Sun Jul 23 15:51:58 BST 2006 succeeded.
The bios time is set to London Time. So is linux
That does not stop shorewall (at 52 seconds) beeing mangled with earlier kernel outputs at (25 seconds)
Distribution: Mandriva mostly, vector 5.1, tried many.Suse gone from HD because bad Novell/Zinblows agreement
Posts: 1,606
Original Poster
Rep:
#grep ZONE /etc/sysconfig/clock
ZONE=Europe/London
# env | grep -i time
LC_TIME=en_GB
I booted with a 2.4 stock mandriva kernel of the distro:
Still mangled syslog.
I installed mandy 2005 on a spare partition (the syslog is fine there,
the one hour problem does not even occur) to try
to diff -ru /etc/rc.d . No definite conclusion yet.
I will try to investigate partmon because it is the first occurence
in the syslog that interleaved with the bios output.
I deleted and created a new empty syslog in case it was too big on the 23/07
or in case there was something wrong with logrotate.
# ls -l /var/log/syslog*
-rw-r----- 1 root root 1105331 Jul 25 17:27 /var/log/syslog
-rw-r----- 1 root root 147422 Jun 25 04:02 /var/log/syslog.1.gz
-rw-r----- 1 root root 336053 Jun 20 04:02 /var/log/syslog.2.gz
-rw-r----- 1 root root 132901 Jun 11 04:02 /var/log/syslog.3.gz
-rw-r----- 1 root root 1359994 Jun 6 04:02 /var/log/syslog.4.gz
-rw-r----- 1 root root 152228 Apr 23 04:02 /var/log/syslog.5.gz
-rw-r----- 1 root root 819601 Jul 23 17:25 /var/log/syslog.old230706.gz
and removed devfs=nomount from grub (no idea why this was in there;
a stock mandy 2005 does not have this parameter. Must have come
when I overwrote grub with other distro when I was learning about grub,
actually probably mandy 2006 when I tried it)
the kernel syslog was less mangled without devfs=nomount,
mangling starts with acpi, then from 19:47:40 it is ok
(this test was with the stock kernel rather than a custom one).
diff -ru /etc/localtime /mandy2005stock/etc/localtime
Shouldn't you compare with /usr/share/zoneinfo/Europe/London ? (or /usr/share/zoneinfo/posix/Continent/City if you want DST)
What I did to combat time skew was:
- change TZ from Continent/City to /usr/share/zoneinfo/posix/Continent/City in /etc/sysconfig/clock (kernel)
- copy (not link) /usr/share/zoneinfo/posix/Continent/City to /etc/localtime (glibc)
- reboot and check /etc resources and running processes for skewed TZ
(- installed NTPd.)
Distribution: Mandriva mostly, vector 5.1, tried many.Suse gone from HD because bad Novell/Zinblows agreement
Posts: 1,606
Original Poster
Rep:
Thanks again for staying with the problem.
Have now copied whole /etc to overwrite /mandy2005stock/etc
(and kept backup of working-fine etc in /mandy2005stock/etcback)
So I have a broken test system /mandy2005stock that I can reboot at will
with the exact grub command from stock.
AFAI can tell so far, the problem file is not /etc/rc* (none of the rc?.d)
nor the /etc/init.rd (whichever the directory name where the init scripts are
for the links in rc?.d)
I can break the system, no prob.
Tried to replicate problem in single mode (grub single keyword), because faster to boot,
but even by editing the /etc/single to remove in it the kills,
and by doing chkconfig --level alsa,syslog,partmon 1 on,
(yes some services enabled at run level 1) I cannot get (much) things written to /syslog
(3 lines about alsa or nothing, cannot remember, so many reboot)
at least not the BIOS map and all these bootmessages I am interested to keep.
Any idea on how to enable single mode with full syslog of boot and services?
Anyhow, working by dichotomy on /etc now because I cannot think of better
Painfull process. I could no pinpoint anything from
diff -ru /mandy2005stock/etcback /mandy2005stock/etc
Quote:
diff -ru /etc/localtime /mandy2005stock/etc/localtime
Shouldn't you compare with /usr/share/zoneinfo/Europe/London ?
Well I know /mandy2005stock/ (a full stock install of the distro) is working ok,
so I compare this way.
Did also previously cp ...zoneinfo/Europe/London /etc/localtime
Did previously a replacement /var/log by /mandy2005stock/var/log
No luck either
Quote:
- reboot and check /etc resources and running processes for skewed TZ
the mangling-trigger seems to be rc.sysinit, but the syslog
is in such a poor state order that even with some greps I cannot be sure
which process is mangling the line
Summary it is not:
/etc/localtime
a kernel issue or size of kernel ring buffer for syslog
somethign or size problem in /var/log
/etc/rc*
/etc/init.d
Distribution: Mandriva mostly, vector 5.1, tried many.Suse gone from HD because bad Novell/Zinblows agreement
Posts: 1,606
Original Poster
Rep:
found the offending lines in /etc/syslog.conf this is were I looked in the first place.
One or more of these are creating the chronological problem,
and I did insert local4 for lm_sensors
1) It is not formated with tab (may not matter)
2) *.info to /var/log/messages contradicts
*.info;mail.none;;news.none;authpriv.none -/var/log/messages
that is I doubt the same file can be accessed sync and async at the same time
4) *.info is duplicated (not good is it?)
But I have learn many things with this problem, so not all bad
Any idea on how to enable single mode with full syslog of boot and services?
Hmm. Maybe add a GRUB entry booting into runlevel 2 and chkconfig services to run in that level. 2 isn't used most of the times anyway so it's free for whatever you want to do with it.
and I did insert local4 for lm_sensors
As long as it conforms to syslog.conf format that should be no problem. What happens with the local4 lines commented out and syslog restarted?
1) It is not formated with tab (may not matter)
With /etc/syslog.conf it *does* matter very much so I've found.
2) *.info to /var/log/messages contradicts *.info;mail.none;;news.none;authpriv.none -/var/log/messages that is I doubt the same file can be accessed sync and async at the same time
Sounds like a solid conclusion.
4) *.info is duplicated (not good is it?)
"*.info" does dump all the information at that level into the log while "*.info;mail.none;;news.none;authpriv.none" filters what could be considered being private information. Duplication isn't the problem (OK, except wrt for performance) but what and where you want to log and for what purpose. If you're using the info for alerting then having less logfiles will mean less files to write and read but probably larger logs (unless more often rotated). If you aren't interested in messages below the warning level then there's no reason to log them.
I'm quite baffled as to how this came to be and still persists.
Maybe it would be good to go back to start and try again.
Are there any kernel or app version difs between this install and your installed stock Mandy?
Distribution: Mandriva mostly, vector 5.1, tried many.Suse gone from HD because bad Novell/Zinblows agreement
Posts: 1,606
Original Poster
Rep:
Quote:
I'm quite baffled as to how this came to be and still persists.
Sorry I did not explain well: The problem is now solved, and it was because of 1) 2) or 4)
(No 3... must I have thought of 1 mroe reason initialy)
It came to be when I inserted
*.info;local4.none;local4.warn /var/log/messages
from the man page of lm_sensors (Never thought about checking congruence for sync/async)
and it is either the tabulations and/or the simultaneous sync and async on /var/log/messages.
I do not know since I removed *.info and made /var/log/messages async everywhere.
So it reads now
local4.none;local4.warn -/var/log/messages
The strange thing though, is that I was looking at a mangled syslog file, not messages.
Now syslog is not mangled anymore. No idea about messages.
Quote:
Maybe it would be good to go back to start and try again.
Well, now it works, I might just test the simultaneous async/sync combination
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
this is were I looked in the first place.
I did insert local4 for lm_sensors
But I have learn many things with this problem, so not all bad
