topic Re: syslog in Operating System - HP-UX

syslog

Indrajit Bhagat — Fri, 14 Sep 2007 10:03:27 GMT

what is the difference between syslog and dmesg.

Re: syslog

A. Clay Stephenson — Fri, 14 Sep 2007 10:07:54 GMT

Dmesg is implemented as a circular buffer of finite size; it's main advantage is that the OS can always report to it even if every filesystem is full but because of circular nature earlier messages can be overwritten by later ones. The syslog is the file written by the syslog deamon (syslogd) and because it is a file rather than a circular buffer, it's size is really only limited by the capacity of the filesystem which hosts the file.

Re: syslog

James R. Ferguson — Fri, 14 Sep 2007 10:32:30 GMT

Hi Indrajit:

To add to Clay's explanation, if you look at the manpages for 'dmesg(1M)' you can see how to setup a periodic extraction of the 'dmesg' buffer should it contain any critical information.

Regards!

...JRF...

Re: syslog

Matti_Kurkela — Fri, 14 Sep 2007 17:00:57 GMT

Normally, the syslogd daemon will automatically read the kernel messages (and forward them to the configured log destinations, if the message priority indicates it's required). So the important messages will automatically flow from the kernel message buffer (dmesg) to syslog.

In a sick machine (one with a critical out-of-memory condition, failing memory or some other serious problem) the syslogd daemon may crash, but the kernel message buffer will function as long as the kernel is still alive... but if the machine is in such a bad state, running the "dmesg" command successfully to see the messages may not be easy.

Note that the messages in the dmesg output don't generally have time stamps, so even the latest message at the end of the listing may be old.

You cannot get your own messages into the "dmesg" listing unless you program your own HP-UX driver, but syslog can be used fairly easily from user programs ("man 3 syslog" for the programming interface) or even scripts (man logger).

MK

Re: syslog

Bill Hassell — Fri, 14 Sep 2007 18:46:13 GMT

dmesg does have timestamps -- you have to run it with the 'newer' option which just a - as in:

dmesg -

The firat time you run it, you see the entire buffer. The next time, you see nothing -- unless something new has been sent to the message buffer. So to create a log with time stamps, put this in root's crontab:

0,10,20,30,40,50 * * * * dmesg - >> /var/adm/dmesg.log

Now you'll have a time-stamped log of dmesg entries.