Bootup Log gathering

ekstrah · 11-11-2018, 05:33 AM

Hello, it's my first time writing this question.

I am currently trying to gather all the logs that are generated by each process during the boot up including the application/program.

my .so file only includes fopen function since I assumed that writing the logs will require using fopen function. (https://gist.github.com/ekstrah/4185...a13f720d698fd5 for more details)

I thought about using LD_PRELOAD by writing export LD_PRELOAD in /etc/profile and also tried making ld.so.preload. This was helpful after the bootup. It didn't really gather information that I needed during the bootup time.

So, I want to ask you guys is there a way of gathering logs that are generated during the boot up time?

ondoho · 11-11-2018, 05:50 AM

why don't you using existing functionality of your init system?
or is the idea to program something from scratch?

ekstrah · 11-11-2018, 05:59 AM

Quote:

Originally Posted by ondoho

why don't you using existing functionality of your init system?

Can you elaborate and explain in more details? How would you approach this problem?

Thank you very much

ondoho · 11-11-2018, 06:06 AM

well it depends on the distro, so i suggest you give us some more detail first.

Thank you very much

ekstrah · 11-11-2018, 06:08 AM

Quote:

Originally Posted by ondoho

well it depends on the distro, so I suggest you give us some more detail first.

I am currently, using "Linux test2 4.4.0-138-generic #164-Ubuntu SMP Tue Oct 2 17:16:02 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux"
Is there any information that I need to provide?

and Thank you very much

ondoho · 11-11-2018, 06:10 AM

i think that's Ubuntu 16.04, so it should be using systemd.

Code:

journalctl -b

there's also

Code:

dmesg

which is init-system independent i think.

ekstrah · 11-11-2018, 06:14 AM

Quote:

Originally Posted by ondoho

i think that's Ubuntu 16.04, so it should be using systemd.

Code:

journalctl -b

there's also

Code:

dmesg

which is init-system independent i think.

It gives out a lot of information about kernel ring buffer, but it doesn't really show which process is writing which logs during the bootup process

ondoho · 11-11-2018, 09:44 AM

oh, journalctl can do more than dmesg.

Code:

man journalctl

you should read up on your init system, which is systemd as i mentioned earlier.

jsbjsb001 · 11-11-2018, 10:05 AM

Have a look in the /var/log/ folder.

Also, while it depends on the syslog implmentation your distribution is using (I don't know what it is on Ubuntu - I haven't checked), if you have a look in the /etc/rsyslog.conf file and scroll down, you should see something like below;

Code:

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

And yes, dmesg should be independent of the init system, and in any distribution I've ever used, it's been there. So ondoho is quite correct AFAIK.