dmesg and syslog

[Omar Alvi_1]

HI,

I had a few queries regarding the relationship between syslog and dmesg.

1- In dmesg, the most recent message appears first?

Since dmesg does not show time, and will retain all critical messages coming to console since last reboot, it will invariably show issues in its output which have already been solved.

2- If I find some message and dmesg, but not in my syslog, can I be 100 % sure that the dmesg issue no longer applies (has been solved)?

Thanks and Regards,

-Alvi

[RAC_1]

1. dmesg shows what is there in /var/adm/msgbuf and hold the lastest information. And msgbuf file has size limitation. So it will be overwritten, if there too many new error messages.

To dig out old errors, syslog.log is the file to look at.

2. Mostly it won't happen that the information is in dmesg and not in syslog.log file. (If you have configured your syslog.conf properly.

Anil

[A. Clay Stephenson]

In large measure dmesg and syslog have little to do with each other. They are completely different things. The main purpose of dmesg is to serve as a message dump when nothing else is available -- for example, before the filesystem that holds syslog has even been mounted. Dmesg actually uses a fixed kernel memory area and as soon as it fills up, something must be discarded to make room for newer data.

How messages are handled is up to the application. Some might use the syslog function but file the data in a completely different log (e.g. mail); some applications might post error messages in both syslog and dmesg.

[Heiner E. Lennackers]

If you want to have a history of the dmesg information and with this a timestamp you can put the following line in your crontab:

0,10,20,30,40,50 * * * * /sbin/dmesg - >>/var/adm/dmesg.log

This will add any new dmesg inforation to the dmesg.log file. You can change the time specifications to get a better timely resolution

[Omar Alvi_1]

Hi all, and thanks for the replies, learnt quite some.

The issue however still bothers me. I have messages in dmesg complaining of invalid inode numbers, or unable to read inode and block no on some particular filesystems

Previously such messages could have appeared when we made some changes, I suspect them to be old ... but not 100 % sure.

Syslog doesn't show these messages.

Is there a way to flush dmesg, to have only new messages come there from a particular point in time?

thanks and Regards,

-Alvi

[Con O'Kelly]

Hi

I don't believe there is a way of actually flushing all messages form the dmesg buffer. These messages are held in memory so you would need to re-boot the system!

Look closely at Heiner's suggestion about logging dmesg to a log file.
Run the following from the command line:
# /usr/sbin/dmesg -

This shows any new messages in dmesg since it was last run.

Cheers
Con

[Petr Simik_1]

concerning your inode complains in log
you can measure utilisation of setting inode
by #sar -v 1 10 this

[Steve Steel]

Hi

If you do a head of /var/adm/syslog/syslog.log you should get the same as dmesg unless there were a lot of dmesg messages


In my opinion in dmesg and not in syslog is a new message

Or at least since last flush

every day hour or what you like run

dmesg -

Then you see messages since previous run and know if they are new

do

dmesg -|while read line
do
logger $line
done

And the messages are copied to the syslog as
format
Date machine user: message

example
Aug 4 15:58:48 topaz root: Aug 4 15:58


Steve Steel