Rsyslog system in-place but i want to ALSO receive in the default logread reliably

Installing and Using OpenWrt
1

Rsyslog is working and sending to an Ubuntu server, however i want to be able to additionally read the log from the router whenever i ssh into it. So my /etc/rsyslog.conf on router is as follows:

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$ActionSendResendLastMsgOnReconnect on
$ActionResumeRetryCount -1

# Log all via TCP
*.*                      @@192.168.0.1:519
& /var/log/localbuffer

I saw this post here where it was suggested that we disable and stop /etc/init.d/log so that it doesnt "swallow" some messages before it reaches the server.

So i disabled it and as you can see my config above & /var/log/localbuffer only sends a copy of the log after it has sent it to the server.
It works perfect with no missed messages, but now im worried that the file /var/log/localbuffer will become too big (if i dont reboot the router since only then will it get emptied).

Can i do it this way or is this redundant? Is there a better way to do this if i disable /etc/init.d/log?

2

My suggestions would be:

  • As you've got off-device persistence, log locally to tmp or another memory-backed file system
    (reduce flash wear)

  • Use logrotate or similar to keep the logs from consuming all of that disk

  • Then use less or a tool of your choice to view the local logs.

3

So basically the way ive got it now, logging to /var/log/localbuffer ? because /var -> /tmp is a link.