Topic: multiple syslogs?

I must say the http://wiki.openwrt.org/doc/howto/extroot overlay with an external USB stick is very cool in 10.3.1. The documentation was a bit all over the place though sad

http://wiki.openwrt.org/doc/howto/usb.storage for example is a bit of mess. I think one should probably ruthlessly remove old docs.

root@pr:~# mount
rootfs on / type rootfs (rw)
/dev/root on /rom type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,relatime,size=14716k)
tmpfs on /dev type tmpfs (rw,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
/dev/sda1 on /overlay type ext4 (rw,relatime,barrier=1,data=ordered)
mini_fo:/overlay on / type mini_fo (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
none on /proc/bus/usb type usbfs (rw,relatime)
root@pr:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 1.9M      1.9M         0 100% /rom
tmpfs                    14.4M    120.0K     14.3M   1% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/sda1                 7.4G    149.9M      6.9G   2% /overlay
mini_fo:/overlay          1.9M      1.9M         0 100% /
root@pr:~# ps | grep log   
  379 root      1388 S    syslogd -C16 
  381 root      1372 S    klogd 
 1195 root      4440 S    supervising syslog-ng
 1196 root      4480 S    /usr/sbin/syslog-ng 
 5381 root      1372 S    grep log

I managed to syslog-ng pumping logs over to https://papertrailapp.com/systems/pr/events

Is it OK to have multiple syslogs running?

Backfire (10.03.1, r29592)

Re: multiple syslogs?

I have noticed a problem.
http://192.168.1.3/cgi-bin/luci/;stok=7105e4899090816995abfd3308bdf248/admin/status/syslog/ is not the same as https://papertrailapp.com/systems/pr/events

For example I only see:

Aug 29 07:57:14 pr user.info sysinit: Optimizing conntrack
Aug 29 07:57:14 pr user.info sysinit: Loading interfaces
Aug 29 07:57:14 pr user.info firewall: adding lan (br-lan) to zone lan
Aug 29 07:57:15 pr authpriv.info dropbear[1193]: Running in background
Aug 29 07:57:16 pr user.info sysinit: setting up led WLAN
Aug 29 07:58:55 pr authpriv.info dropbear[1376]: Child connection from 192.168.1.128:59575
Aug 29 07:59:51 pr authpriv.notice dropbear[1376]: Password auth succeeded for 'root' from 192.168.1.128:59575

Under luci.

This is my config:

options {
chain_hostnames(no);
create_dirs(yes);
flush_lines(0);
keep_hostname(yes);
log_fifo_size(256);
log_msg_size(1024);
stats_freq(0);
flush_lines(0);
use_fqdn(no);
};

source src {
internal();
unix-stream("/dev/log");
};


destination d_papertrail {
  udp("logs.papertrailapp.com" port(XXXXXX));
  };
  
source net {
udp(ip(0.0.0.0) port(514));
};

source kernel {
        file("/proc/kmsg" program_override("kernel"));
};

destination messages {
file("/var/log/messages");
};

log {
source(src);
source(net);
        source(kernel);
destination(d_papertrail);
};
Backfire (10.03.1, r29592)

Re: multiple syslogs?

Is this bug related ? https://dev.openwrt.org/ticket/3981

I noticed there is extra cron debug from `logread` but not from syslog-ng3 sad

Backfire (10.03.1, r29592)