is it safe to store logs with size control in overlayfs(/etc) so I can retrieve it after reboot. ?
Logs are being written constantly, that would kill the flash memory on your device... perhaps on a disposable external USB memory.
1 Like
Logging to a remote device is an option (look here).
I have tried this and it works; however, if your looking to catch a kernel panic you likely won't see it as the system will stop before anything can put the log to the network (or your flash memory or an external usb). In this case, a serial console/jtag device using a program like screen with logging is likely your best option (I've still missed some kernel panics even doing this tho).
For some devices there is also the "ramoops" kernel module to save kernel logs to "pstore" memory that can be accessed after a reboot.