LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Arch
User Name
Password
Arch This Forum is for the discussion of Arch Linux.

Notices


Reply
  Search this Thread
Old 06-26-2018, 03:43 PM   #1
porphyry5
Member
 
Registered: Jul 2010
Location: oregon usa
Distribution: Slackware 14.1, Arch
Posts: 465

Rep: Reputation: 21
capture system messages before udev starts


I have current arch installed on lenovo ideapad 110s

When refind boots linux, almost immediately, before udev is started, system prints messages heavily decorated with asterisks about root cannot be mounted (messages pass by too quickly for me to read).
On the one hand the system functions so why worry; but on the other hand it maybe warning me of some error condition on the hard drive that I should fix.

How can I capture these early sytem messages (not in dmesg)? Shift-PgUp does not scroll the screen back. /var/log/messages is empty.
 
Old 06-27-2018, 09:01 AM   #2
RandomTroll
Senior Member
 
Registered: Mar 2010
Distribution: Slackware
Posts: 1,165

Rep: Reputation: 188Reputation: 188
/var/log/syslog?
 
Old 06-27-2018, 12:45 PM   #3
porphyry5
Member
 
Registered: Jul 2010
Location: oregon usa
Distribution: Slackware 14.1, Arch
Posts: 465

Original Poster
Rep: Reputation: 21
Quote:
Originally Posted by RandomTroll View Post
/var/log/syslog?
The content of my /var/log is
Code:
|/journal                                                 │   4096│Jun 12 18:27│
│/old                                                     │   4096│Jan  5 11:17│
│ btmp                                                    │      0│Jun 12 18:27│
│ faillog                                                 │  32032│Jun 26 12:13│
│ lastlog                                                 │ 292292│Jun 27 09:53│
│ pacman.log                                              │  67879│Jun 27 09:55│
│ tallylog                                                │  64064│Jun 12 18:21│
│ wtmp                                                    │ 255744│Jun 27 09:53│
Excepting the package manager's history pacman.log, every file, including in subdirectories, is binary. lastlog and wtmp seem promising, but both are largely hex zeros.

Searching the system for variations on syslog produced only 2 results that seemed hopeful
Code:
~ $ sudo find / -name '*syslog*'
/sys/kernel/debug/tracing/events/syscalls/sys_enter_syslog
/sys/kernel/debug/tracing/events/syscalls/sys_exit_syslog
But attempting to examine these things produced strange results
Code:
~ $ sudo cd /sys/kernel/debug/tracing/events/syscalls
sudo: cd: command not found

~ $ sudo vim /sys/kernel/debug/tracing/events/syscalls/sys_enter_syslog
" ============================================================================
" Netrw Directory Listing                                        (netrw v156)
"   /sys/kernel/debug/tracing/events/syscalls/sys_enter_syslog
"   Sorted by      name
"   Sort sequence: [\/]$,\<core\%(\.\d\+\)\=\>,\.h$,\.c$,\.cpp$,\~\=\*$,*,\.o$,\.obj$,\.info$,\.swp$,\.bak$,\~$
"   Quick Help: <F1>:help  -:go up dir  D:delete  R:rename  s:sort-by  x:special
" ==============================================================================
../
./
enable
filter
format
hist
id
trigger
None of the six files contained anything of interest.
 
Old 06-27-2018, 01:35 PM   #4
RandomTroll
Senior Member
 
Registered: Mar 2010
Distribution: Slackware
Posts: 1,165

Rep: Reputation: 188Reputation: 188
You aren't running syslogd. Start.
 
1 members found this post helpful.
Old 06-28-2018, 12:56 AM   #6
RandomTroll
Senior Member
 
Registered: Mar 2010
Distribution: Slackware
Posts: 1,165

Rep: Reputation: 188Reputation: 188
I always see error messages during boot that don't show up in dmesg - or anywhere in /var/log. When they matter I write them down by hand.
 
Old 06-28-2018, 12:39 PM   #7
porphyry5
Member
 
Registered: Jul 2010
Location: oregon usa
Distribution: Slackware 14.1, Arch
Posts: 465

Original Poster
Rep: Reputation: 21
Quote:
Originally Posted by RandomTroll View Post
You aren't running syslogd. Start.
Thank you for the suggestion, but I'm not sure it will help.
According to this post https://bbs.archlinux.org/viewtopic.php?id=151363 arch does not include syslogd by default, uses journalctl instead, whose output for today is
Code:
Jun 28 09:10:01 a systemd[362]: Reached target Paths.
Jun 28 09:10:01 a systemd[362]: Listening on GnuPG cryptographic agent and pass>
Jun 28 09:10:01 a systemd[362]: Starting D-Bus User Message Bus Socket.
Jun 28 09:10:01 a systemd[362]: Listening on GnuPG network certificate manageme>
Jun 28 09:10:01 a systemd[362]: Listening on GnuPG cryptographic agent (ssh-age>
Jun 28 09:10:01 a systemd[362]: Listening on GnuPG cryptographic agent and pass>
Jun 28 09:10:01 a systemd[362]: Listening on GnuPG cryptographic agent and pass>
Jun 28 09:10:01 a systemd[362]: Reached target Timers.
Jun 28 09:10:01 a systemd[362]: Listening on D-Bus User Message Bus Socket.
Jun 28 09:10:01 a systemd[362]: Reached target Sockets.
Jun 28 09:10:01 a systemd[362]: Reached target Basic System.
Jun 28 09:10:01 a systemd[362]: Reached target Default.
Jun 28 09:10:01 a systemd[362]: Startup finished in 78ms.
Jun 28 09:19:12 a systemd[362]: Started D-Bus User Message Bus.
Jun 28 09:19:13 a dbus-daemon[952]: [session uid=1000 pid=952] Activating via s>
Jun 28 09:19:13 a systemd[362]: Starting Accessibility services bus...
Jun 28 09:19:13 a dbus-daemon[952]: [session uid=1000 pid=952] Successfully act>
Jun 28 09:19:13 a systemd[362]: Started Accessibility services bus.
Jun 28 09:19:15 a dbus-daemon[952]: [session uid=1000 pid=952] Activating servi>
Jun 28 09:19:15 a dbus-daemon[952]: [session uid=1000 pid=952] Successfully act>
lines 3689-3746/3746 (END)
Which does not include the messages of interest. According to https://wiki.archlinux.org/index.php/Systemd#Journal
Quote:
Journal

systemd has its own logging system called the journal; therefore, running a syslog daemon is no longer required. To read the log, use:

# journalctl
I'm assuming the messages I wish to capture precede systemd's startup.
 
Old 06-28-2018, 06:37 PM   #8
RandomTroll
Senior Member
 
Registered: Mar 2010
Distribution: Slackware
Posts: 1,165

Rep: Reputation: 188Reputation: 188
syslogd records hundreds of messages before udev loads on my system. If it doesn't interfere with journalctl I recommend you try running it just to see what happens. I'd be surprised if you can't run it at all.

I looked at the page to which you referred me; it looks as though journalctl should record the same stuff. Maybe you need to look at a different file or pass an argument to journalctl to read them. I run Slackware (perhaps I shouldn't answer an Arch forum question.)
 
1 members found this post helpful.
Old 06-29-2018, 05:24 AM   #9
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 11,018
Blog Entries: 7

Rep: Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772
Quote:
Originally Posted by porphyry5 View Post
Thank you for the suggestion, but I'm not sure it will help.
According to this post https://bbs.archlinux.org/viewtopic.php?id=151363 arch does not include syslogd by default, uses journalctl instead
maybe that was so in 2012.
a lot has changed since then.
it is also irrelevant to your request.

Quote:
I'm assuming the messages I wish to capture precede systemd's startup.
you assume correctly.
and dmesg does that on my system (archlinux).
try:
Code:
sudo dmesg | head
followed by
Code:
sudo dmesg|grep -niEm1 -B10 'systemd|udev'
very clearly (at least on my system) the dmesg log starts with loading the linux kernel, then 600 lines and 3 seconds later it starts systemd.
 
1 members found this post helpful.
Old 06-29-2018, 12:27 PM   #10
porphyry5
Member
 
Registered: Jul 2010
Location: oregon usa
Distribution: Slackware 14.1, Arch
Posts: 465

Original Poster
Rep: Reputation: 21
Quote:
Originally Posted by ondoho View Post
and dmesg does that on my system (archlinux).
try:
Code:
sudo dmesg | head
followed by
Code:
sudo dmesg|grep -niEm1 -B10 'systemd|udev'
very clearly (at least on my system) the dmesg log starts with loading the linux kernel, then 600 lines and 3 seconds later it starts systemd.
Thank you for your help, dmesg does as you say, see following code box. But as I said in my first post, it does not list the console messages that concern me.
Code:
~ $ sudo dmesg|head
[    0.000000] Linux version 4.17.2-1-ARCH (builduser@heftig-9574) (gcc version 8.1.1 20180531 (GCC)) #1 SMP PREEMPT Sat Jun 16 11:08:59 UTC 2018
[    0.000000] Command line: \\boot\vmlinuz-linux ro root=UUID=f2dda047-0a99-43e3-9c67-cec5b4961d81 initrd=boot\initramfs-linux.img
[    0.000000] KERNEL supported cpus:
[    0.000000]   Intel GenuineIntel
[    0.000000]   AMD AuthenticAMD
[    0.000000]   Centaur CentaurHauls
[    0.000000] x86/fpu: x87 FPU will use FXSAVE
[    0.000000] e820: BIOS-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x0000000000057fff] usable
[    0.000000] BIOS-e820: [mem 0x0000000000058000-0x0000000000058fff] ACPI NVS
~ $ sudo dmesg|grep -niEm1 -B10 'systemd|udev'
590-[    2.749259] usb 1-3: New USB device strings: Mfr=0, Product=0, SerialNumber=0
591-[    2.753906] sdhci-pci 0000:00:12.0: SDHCI controller found [8086:2296] (rev 35)
592-[    2.754846] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
593-[    2.880034] usb 1-4: new high-speed USB device number 3 using xhci_hcd
594-[    3.027963] usb 1-4: New USB device found, idVendor=0781, idProduct=5583, bcdDevice= 1.00
595-[    3.027968] usb 1-4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
596-[    3.027970] usb 1-4: Product: Ultra Fit
597-[    3.027971] usb 1-4: Manufacturer: SanDisk
598-[    3.027973] usb 1-4: SerialNumber: 4C531001331212109152
599-[    3.029141] sdhci-pci 0000:00:12.0: SDHCI controller found [8086:2296] (rev 35)
600:[    3.084394] systemd[1]: systemd 238 running in system mode. (+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK -SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN +PCRE2 default-hierarchy=hybrid)
~ $
The HD is mounted, bolded, but no messages saying root cannot be mounted.
 
Old 06-29-2018, 12:37 PM   #11
porphyry5
Member
 
Registered: Jul 2010
Location: oregon usa
Distribution: Slackware 14.1, Arch
Posts: 465

Original Poster
Rep: Reputation: 21
Quote:
Originally Posted by RandomTroll View Post
I looked at the page to which you referred me; it looks as though journalctl should record the same stuff. Maybe you need to look at a different file or pass an argument to journalctl to read them. I run Slackware (perhaps I shouldn't answer an Arch forum question.)
I don't think my problem is specific to any particular distro, and I appreciate your help.

Quote:
Originally Posted by RandomTroll View Post
syslogd records hundreds of messages before udev loads on my system. If it doesn't interfere with journalctl I recommend you try running it just to see what happens. I'd be surprised if you can't run it at all.
I have installed syslogd, now its a matter of getting it to run, it seems it needs to be started by 'init', but all this is new to me. I've always avoided meddling with the system, just thankful that it does its job so well.
 
Old 06-29-2018, 02:10 PM   #12
RandomTroll
Senior Member
 
Registered: Mar 2010
Distribution: Slackware
Posts: 1,165

Rep: Reputation: 188Reputation: 188
does the -k switch to journalctl give you what you want?

syslogd is just a program. You can just run it. The only hitch is that you can't run it too early - I don't know when that is. On my system it runs from /etc/rc.d/rc.M by /etc/rc.d/rc.syslog.

I read the journalctl doc more. I bet it has the same information, you just have to know how to look for it. syslogd stores most of what it reports in plain text files. journalctl may do the same, just with different names.

Last edited by RandomTroll; 06-29-2018 at 04:43 PM.
 
1 members found this post helpful.
Old 06-30-2018, 03:56 AM   #13
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 11,018
Blog Entries: 7

Rep: Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772Reputation: 2772
if the messages you mention aren't even in dmesg, i have my doubts if syslogd can help.
worth a try of course.
i'd go back to a previously mentioned kernel option to pause after every step or message or some such, i'm sure it was in this thread (edit: maybe one of the links to archwiki).
at least try it out.

Last edited by ondoho; 06-30-2018 at 03:58 AM.
 
1 members found this post helpful.
Old 07-01-2018, 12:54 PM   #14
porphyry5
Member
 
Registered: Jul 2010
Location: oregon usa
Distribution: Slackware 14.1, Arch
Posts: 465

Original Poster
Rep: Reputation: 21
Quote:
Originally Posted by RandomTroll View Post
does the -k switch to journalctl give you what you want?

syslogd is just a program. You can just run it. The only hitch is that you can't run it too early - I don't know when that is. On my system it runs from /etc/rc.d/rc.M by /etc/rc.d/rc.syslog.

I read the journalctl doc more. I bet it has the same information, you just have to know how to look for it. syslogd stores most of what it reports in plain text files. journalctl may do the same, just with different names.
journalctl -k produces lots more messages, but still not the ones I'm looking for. I think what I'll do is try filming the screen as the system boots, then run the video in mplayer. Its '.' command shifts one frame at a time, so that should pin it down. Many thanks for all your help, much appreciated.
 
Old 07-01-2018, 12:56 PM   #15
porphyry5
Member
 
Registered: Jul 2010
Location: oregon usa
Distribution: Slackware 14.1, Arch
Posts: 465

Original Poster
Rep: Reputation: 21
Quote:
Originally Posted by ondoho View Post
if the messages you mention aren't even in dmesg, i have my doubts if syslogd can help.
worth a try of course.
i'd go back to a previously mentioned kernel option to pause after every step or message or some such, i'm sure it was in this thread (edit: maybe one of the links to archwiki).
at least try it out.
Don't know about kernel options, but thanks for the idea. I think what I'll do is try filming the screen as the system boots, then run the video in mplayer. Its '.' command shifts one frame at a time, so that should pin it down. Many thanks for all your help, much appreciated.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
I can't capture error messages JBB Linux - General 5 02-28-2014 03:26 PM
How to capture boot messages? Torben Friis Mandriva 16 11-14-2010 07:52 PM
[SOLVED] Chose udev for services... udev starts twice... hotplug fails flipjarg Linux - Newbie 2 09-19-2010 12:49 PM
udev error messages aspartat Slackware 1 09-11-2006 01:19 PM
SSHD starts and dies without any error messages bugg_tb Linux - Software 3 04-19-2006 06:22 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Arch

All times are GMT -5. The time now is 12:48 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration