Syslog messages from bootup lost

Installing and Using OpenWrt
1

I am using syslog to collect router logs on remote machine and just realized several log entries are not making it through after system start. In a proprietary implementation of OpenWrt I've managed to solve it by editing /etc/init.d/syslog:

	syslogd -C -m 0
	sleep 10
	logread | nc $SyslogIP 514
	killall syslogd
	syslogd -L -R $SyslogIP -m 0

Unfortunately I am too lame to setup the same with current /etc/init.d/log and /etc/init.d/system mixture.
Has anybody an idea how to achieve similar result with modern procd init scripts?

2

I believe the problem may from logread -f being used for other loggers and it looks like you've gotten around it in much the same way as my "hack" with the equivalent of

  • logread to get the current buffer (your script)
  • logread -f to get new additions (restarting syslogd)
3

Maybe that is not the most elegant solution but I've managed to obtain desired behaviour by placing following line in /etc/rc.local:

(logIP=$(uci get system.@system[0].log_ip); uci delete system.@system[0].log_ip; /etc/init.d/log restart; until (ping -c 2 -q $logIP); do sleep 1; done; uci set system.@system[0].log_ip="$logIP"; logread | nc $logIP 514; /etc/init.d/log restart) &

As a result log from just after restart until syslog server is reachable is being sent out to remote server as well. So no initial log entries (containing usually a lot of useful info) are lost anymore.
Note: above command is sending log messages over TCP so it might be needed to enable TCP on server side in addition to standard UDP listener.

4

Or a slightly different approach. I am setting up tmp_ip via uci to preserve our logging server IP and disable sending logs over network by default only to start it explicitly once server is reachable:

uci set system.@system[0].tmp_ip=$(uci get system.@system[0].log_ip)
uci delete uci get system.@system[0].log_ip
uci commit

then the line will look like:

(logIP=$(uci get system.@system[0].tmp_ip); until (ping -c 2 -q $logIP); do sleep 1; done; uci set system.@system[0].log_ip="$logIP"; logread | nc $logIP 514; /etc/init.d/log restart) &

The drawback is luci is showing log entries starting from /etc/init.d/log restart.

5

I have raised a feature request for that at GitHub (https://github.com/josefbacik/busybox/issues/4). Feel free to vote or comment.