0

I have the following syslog-ng config

@version: 4.6
#
# Syslog-ng default configuration file for Gentoo Linux

# https://bugs.gentoo.org/426814
@include "scl.conf"

options {
    threaded(yes);
    chain_hostnames(no);

    # The default action of syslog-ng is to log a STATS line
    # to the file every 10 minutes.  That's pretty ugly after a while.
    # Change it to every 12 hours so you get a nice daily update of
    # how many messages syslog-ng missed (0).
    stats(freq(43200));
    # The default action of syslog-ng is to log a MARK line
    # to the file every 20 minutes.  That's seems high for most
    # people so turn it down to once an hour.  Set it to zero
    # if you don't want the functionality at all.
    mark_freq(3600);
};

source src { system(); internal(); };

destination messages { file("/var/log/messages"); };
destination kern { file("/var/log/kern.log"); };
destination auth { file("/var/log/auth.log"); };
destination mail { file("/var/log/mail.log"); };

filter kern_f { level(debug..emerg) and facility(kern); };
filter auth_f { level(debug..emerg) and facility(auth) and facility(authpriv); };
filter mail_f { level(debug..emerg) and facility(mail); };
filter default_f { level(debug..emerg) and not (facility(mail)) and not (facility(auth)) and not (facility(kern)); };

# By default messages are logged to tty12...
destination console_all { file("/dev/tty12"); };
# ...if you intend to use /dev/console for programs like xconsole
# you can comment out the destination line above that references /dev/tty12
# and uncomment the line below.
#destination console_all { file("/dev/console"); };

log { source(src); filter(default_f); destination(messages); };
log { source(src); filter(auth_f); destination(auth); };
log { source(src); filter(kern_f); destination(kern); };
log { source(src); filter(mail_f); destination(mail); };
log { source(src); destination(console_all); };

But my kern.log only displays the following logs now:

Jun  7 21:48:03 ash kernel: Loading firmware: rtl_nic/rtl8168h-2.fw
Jun  7 21:48:03 ash kernel: Generic FE-GE Realtek PHY r8169-0-700:00: at
tached PHY driver (mii_bus:phy_addr=r8169-0-700:00, irq=MAC)
Jun  7 21:48:03 ash kernel: r8169 0000:07:00.0 enp7s0: Link is Down
Jun  7 21:48:03 ash kernel: warning: `grep' uses wireless extensions whi
ch will stop working for Wi-Fi 7 hardware; use nl80211
Jun  7 21:48:04 ash kernel: (udev-worker) (887) used greatest stack dept
h: 11720 bytes left
Jun  7 21:48:04 ash kernel: iwlwifi 0000:00:14.3: Registered PHC clock:
iwlwifi-PTP, with index: 0
Jun  7 21:48:07 ash kernel: wlp0s20f3: authenticate with **:**:**:**:**:** (local address=**:**:**:**:**:**)
Jun  7 21:48:07 ash kernel: wlp0s20f3: send auth to **:**:**:**:**:** (t
ry 1/3)
Jun  7 21:48:07 ash kernel: wlp0s20f3: authenticated
Jun  7 21:48:07 ash kernel: wlp0s20f3: associate with **:**:**:**:**:**
(try 1/3)
Jun  7 21:48:07 ash kernel: wlp0s20f3: RX AssocResp from **:**:**:**:**:** (capab=0x1111 status=0 aid=5)
Jun  7 21:48:07 ash kernel: wlp0s20f3: associated
Jun  7 21:48:13 ash kernel: Bluetooth: RFCOMM TTY layer initialized
Jun  7 21:48:13 ash kernel: Bluetooth: RFCOMM socket layer initialized
Jun  7 21:48:13 ash kernel: Bluetooth: RFCOMM ver 1.11

When using sysklogd I used to get all the info logs but after switching to syslog-ng, I don't see that happening?

Any reason why this is happening?

EDIT 1:

System kernel details :

Linux ash 6.9.3-gentoo #1 SMP PREEMPT_DYNAMIC Mon Jun 3 21:46:01 IST 2024 x86_64 Intel(R) Core(TM) i5-10300H CPU @ 2.50GHz GenuineIntel GNU/Linux

EDIT 2:

Changed the default kernel loglevel to 6 in the grub configuration, logs after boot indicating loglevel is explicitly set:

dmesg -l info
[    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.9.3-gentoo root=PARTUUID=4a5f5d65-81be-e24d-bedc-aeb2f0b24295 ro loglevel=6 i8042.nopnp mmio_stale_data=full libata.noacpi=1 resume=PARTUUID=c302ea25-d8e2-064e-8ebd-c79276fad2cc drm.edid_firmware=edid/1920x1080_BOE08E8.bin nvidia-drm.modeset=1

But still the issue persists, I don't see any kernel logs corresponding to info loglevel.

Suprisingly, the loglevel is actually not set,

If I do a cat /proc/sys/kernel/printk, I see the following output,

1       4       1       7

The default log level indicated by the first integer in the above output is still 1.

New contributor
Sai Chaithanya is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

2 Answers 2

0

Maybe sysklogd sets the kernel logging level automatically, whereas syslog-ng does not.

https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels

You can reconfigure those in /proc/sys/kernel/printk

klogd does seem to adjust kernel logging levels: https://linux.die.net/man/8/klogd

2
  • Yes, syslog-ng does not set it explicitly. Hence, the reason that I have set it manually as shown above in the config file. Commented Jun 9 at 13:35
  • Even though I have explicitly changed the default kernel log level to 6, I don't see any change and the issue still persists. Refer to the edit for more details. Commented Jun 9 at 17:22
0

Kernel logs are sent to /proc/kmsg. Defining a new source on this file and redirecting those logs to a custom destination solved the issue.

source kern_src { file("/proc/kmsg"); };
filter kern_f { level(debug..emerg) and facility(kern); };
destination kern_dst { file("/var/log/kern.log"); };
log { source(kern_src); filter(kern_f); destination(kern_dst); };

Updated syslog-ng config file from the one posted in the question.

    @version: 4.7
#
# Syslog-ng default configuration file for Gentoo Linux

# https://bugs.gentoo.org/426814
@include "scl.conf"

options {
    threaded(yes);
    chain_hostnames(no);

    # The default action of syslog-ng is to log a STATS line
    # to the file every 10 minutes.  That's pretty ugly after a while.
    # Change it to every 12 hours so you get a nice daily update of
    # how many messages syslog-ng missed (0).
    stats(freq(43200));
    # The default action of syslog-ng is to log a MARK line
    # to the file every 20 minutes.  That's seems high for most
    # people so turn it down to once an hour.  Set it to zero
    # if you don't want the functionality at all.
    mark_freq(3600);
};

source src { system(); internal(); };
source kern_src { file("/proc/kmsg"); };

destination messages { file("/var/log/messages"); };
destination kern_dst { file("/var/log/kern.log"); };
destination auth_dst { file("/var/log/auth.log"); };
destination mail_dst { file("/var/log/mail.log"); };

filter kern_f { level(debug..emerg) and facility(kern); };
filter auth_f { level(debug..emerg) and facility(auth) and facility(authpriv); };
filter mail_f { level(debug..emerg) and facility(mail); };
filter default_f { level(debug..emerg) and not (facility(mail)) and not (facility(auth)) and not (facility(kern)); };

# By default messages are logged to tty12...
destination console_all { file("/dev/tty12"); };
# ...if you intend to use /dev/console for programs like xconsole
# you can comment out the destination line above that references /dev/tty12
# and uncomment the line below.
#destination console_all { file("/dev/console"); };

log { source(src); filter(default_f); destination(messages); };
log { source(src); filter(auth_f); destination(auth_dst); };
log { source(src); filter(kern_f); destination(kern_dst); };
log { source(src); filter(mail_f); destination(mail_dst); };
log { source(kern_src); filter(kern_f); destination(kern_dst); };
log { source(src); destination(console_all); };
New contributor
Sai Chaithanya is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .