System Log persistent across reboots

For Developers
1

Hi

I have enabled log writing to /var/log/messages using the following in /etc/config/system

    option log_proto 'udp'
    option log_file '/var/log/messages'
    option log_size '256'
    option log_type 'file'

But The file is not persisted across reboots some reboots or as it seems so. It enabled file writing on Sep 27 but the first row in the file now is from 1st Oct.

Is the file being rotated and written somewhere else not in /var/log ?
OR
Can it be that the log size is too small (256) and it is being overwritten?

If it is the size that is too low how much can I set it to? I am using Raspberry Pi3 and have plenty of space in the filesystem.

2

/var is usually an alias for /tmp in Openwrt LEDE, so it is ramdisk.

3

Search the LEDE + OpenWrt forums, you should find several threads dealing with logging to persistent destinations.

4

you probably don't want to log to the router flash (limited resource, limited
writes, impossible to replace), send the logs to a remote host or configure to
write to a USB drive (use rsyslog or syslog-ng if you are doing anything more
than just sending logs to a remote destination that are always going to be <1k)

5

This is how filesystems look like. /var is located on / partition which is /dev/root device, ext. Are you sure it is a ramdisk?

Sending logs to separate logserver is a pain since I will need to set one up and logserver is really boring. If it is really a ramdisk then of course I do not want to write to it.

But shouldn't it be possible to mount a sdcard which is in the PI3 or take some of it's disk and create a partition ...

root@ROOter:~# mount
/dev/root on / type ext4 (rw,noatime,block_validity,delalloc,barrier,user_xattr)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
/dev/mmcblk0p1 on /boot type vfat (rw,noatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
tmpfs on /dev type tmpfs (rw,nosuid,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)
root@ROOter:~# df -h
Filesystem Size Used Available Use% Mounted on
/dev/root 252.0M 25.6M 221.3M 10% /
tmpfs 464.9M 2.0M 462.8M 0% /tmp
/dev/mmcblk0p1 19.9M 9.4M 10.5M 47% /boot
tmpfs 512.0K 0 512.0K 0% /dev

6

Try yourself:

touch /var/test
touch /test
reboot

I guess after the reboot the /var/test is gone, while /test still is there.

Sure, just do it.

7

No, of course I am not sure about your system...

But this is how it looks like in most LEDE devices:

   \  DE    \  /    Reboot (SNAPSHOT, r4969-67ac017fef)
    \________\/    -----------------------------------------------------------

root@LEDE:~# ls -l /
drwxr-xr-x    2 root     root           790 Oct  2 22:46 bin
...
dr-xr-xr-x   11 root     root             0 Jan  1  1970 sys
drwxrwxrwt   19 root     root           540 Oct  3 19:27 tmp
drwxr-xr-x    7 root     root           101 Oct  2 22:46 usr
lrwxrwxrwx    1 root     root             4 Oct  2 22:46 var -> /tmp
drwxr-xr-x    4 root     root            67 Oct  2 22:46 www

/var gets symlinked to /tmp