How to capture system console messages

[Monte Heeren]

I need to capture all system console messages to a log file. Syslog.log is not capturing all messages on my console. My syslog.conf file is:
mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.debug /var/adm/syslog/console.log
*.alert root
*.emerg *
syslog.conf: END

I added the *.debug line to log messages to console.log. Not all messages are making it to that file. The goal is to log all messages to a file, and I can tail -f that file at my desk to watch system messages. Sometimes we have programs that display messages that I can not see, because they are not logged and have scrolled off the console. Any suggestions?

[Avinash20]

Refer thread
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=662658

[Monte Heeren]

Thank you for the reply. Correction, I do not need to log every console message. We have 3rd party software running on our system that displays messages and errors to the system console. Trying to capture those messages. I have asked the software vendor how to capture the messages, but no response. The *.debug option is not working.

[Matti_Kurkela]

Note that you must use TAB in the syslog.conf file, not spaces. After editing the syslog.conf file, you should send a "kill -HUP" to the syslog daemon to make it reload the configuration file.

If this does not help, then the 3rd party software obviously does not use syslog for its messaging.

How is that 3rd party software started?

For any program that starts via /etc/inittab, the standard output and standard error will point to the console, unless explicitly redirected elsewhere.

If the software starts using a typical init script (located in /sbin/init.d), you should examine the script to see where the output of the software is directed. If the software startup includes specific redirections like "> /dev/console", just change them to point to a file instead of the console.

MK

[Monte Heeren]

Matti,
Thank you for the reply. The 3rd party software is fired through a PC front end. The windows app calls a program on the Unix box.

[OldSchool]

as noted, if it writes directly to /dev/console you may not be able to get at it. In this case, I would expect that the 3rd party code *doesn't* use the syslog facility.

if it starts something and redirects the output via the ">" operator, then you might be able to get at it of you can access the startup code for the application. (Its entirely possible that the 3rd party stuff is started at boot time and listening to a socket for input from windows.....)

If it does happen to use syslog facility, and all of the messages you want to see are being displayed on the console, then using the syslog.conf file that you provided, duplicate every line that has /dev/console in it and substitute /var/adm/syslog/console.log...

should wind up with something like:

mail.debug /var/adm/syslog/mail.log
*.info;mail.none /var/adm/syslog/syslog.log
*.alert /dev/console
*.alert /var/adm/syslog/console.log
*.debug /var/adm/syslog/console.log
*.alert root
*.emerg *

without knowing what the "3rd party software" is, or how does what it does, all of the above are just unverifiable guesses.

as noted above, the syslog daemon will need restarted.

pester the vendor of the software until they provide answers as to how they display the messages on the console as that's why you pay for support.

[Monte Heeren]

OldSchool,
Thank you for the info. I'm going to pester the 3rd party software vendor more. Maybe if I'm persistent, they can explain how the messages are displaying on the console.

[Michael Mike Reaser · Accepted solution]

Monte - it's entirely possible that the 3rd-party vendor is doing something along the lines of

some_command 2>/dev/console

or

/a/b/c/some_script 2>/dev/console

or, inside "/d/e/f/some_other_script" they have a line

some_other_command >/dev/console

IOW, the messages from the 3rd-party s/w may be sent directly to your console device, in which case it's going to be up to the vendor to explain to you how to capture them.