0

I have the following syslog-ng config

@version: 4.6
#
# Syslog-ng default configuration file for Gentoo Linux

# https://bugs.gentoo.org/426814
@include "scl.conf"

options {
    threaded(yes);
    chain_hostnames(no);

    # The default action of syslog-ng is to log a STATS line
    # to the file every 10 minutes.  That's pretty ugly after a while.
    # Change it to every 12 hours so you get a nice daily update of
    # how many messages syslog-ng missed (0).
    stats(freq(43200));
    # The default action of syslog-ng is to log a MARK line
    # to the file every 20 minutes.  That's seems high for most
    # people so turn it down to once an hour.  Set it to zero
    # if you don't want the functionality at all.
    mark_freq(3600);
};

source src { system(); internal(); };

destination messages { file("/var/log/messages"); };
destination kern { file("/var/log/kern.log"); };
destination auth { file("/var/log/auth.log"); };
destination mail { file("/var/log/mail.log"); };

filter kern_f { level(debug..emerg) and facility(kern); };
filter auth_f { level(debug..emerg) and facility(auth) and facility(authpriv); };
filter mail_f { level(debug..emerg) and facility(mail); };
filter default_f { level(debug..emerg) and not (facility(mail)) and not (facility(auth)) and not (facility(kern)); };

# By default messages are logged to tty12...
destination console_all { file("/dev/tty12"); };
# ...if you intend to use /dev/console for programs like xconsole
# you can comment out the destination line above that references /dev/tty12
# and uncomment the line below.
#destination console_all { file("/dev/console"); };

log { source(src); filter(default_f); destination(messages); };
log { source(src); filter(auth_f); destination(auth); };
log { source(src); filter(kern_f); destination(kern); };
log { source(src); filter(mail_f); destination(mail); };
log { source(src); destination(console_all); };

But my kern.log only displays the following logs now:

Jun  7 21:48:03 ash kernel: Loading firmware: rtl_nic/rtl8168h-2.fw
Jun  7 21:48:03 ash kernel: Generic FE-GE Realtek PHY r8169-0-700:00: at
tached PHY driver (mii_bus:phy_addr=r8169-0-700:00, irq=MAC)
Jun  7 21:48:03 ash kernel: r8169 0000:07:00.0 enp7s0: Link is Down
Jun  7 21:48:03 ash kernel: warning: `grep' uses wireless extensions whi
ch will stop working for Wi-Fi 7 hardware; use nl80211
Jun  7 21:48:04 ash kernel: (udev-worker) (887) used greatest stack dept
h: 11720 bytes left
Jun  7 21:48:04 ash kernel: iwlwifi 0000:00:14.3: Registered PHC clock:
iwlwifi-PTP, with index: 0
Jun  7 21:48:07 ash kernel: wlp0s20f3: authenticate with **:**:**:**:**:** (local address=**:**:**:**:**:**)
Jun  7 21:48:07 ash kernel: wlp0s20f3: send auth to **:**:**:**:**:** (t
ry 1/3)
Jun  7 21:48:07 ash kernel: wlp0s20f3: authenticated
Jun  7 21:48:07 ash kernel: wlp0s20f3: associate with **:**:**:**:**:**
(try 1/3)
Jun  7 21:48:07 ash kernel: wlp0s20f3: RX AssocResp from **:**:**:**:**:** (capab=0x1111 status=0 aid=5)
Jun  7 21:48:07 ash kernel: wlp0s20f3: associated
Jun  7 21:48:13 ash kernel: Bluetooth: RFCOMM TTY layer initialized
Jun  7 21:48:13 ash kernel: Bluetooth: RFCOMM socket layer initialized
Jun  7 21:48:13 ash kernel: Bluetooth: RFCOMM ver 1.11

When using sysklogd I used to get all the info logs but after switching to syslog-ng, I don't see that happening?

Any reason why this is happening?

EDIT 1:

System kernel details :

Linux ash 6.9.3-gentoo #1 SMP PREEMPT_DYNAMIC Mon Jun 3 21:46:01 IST 2024 x86_64 Intel(R) Core(TM) i5-10300H CPU @ 2.50GHz GenuineIntel GNU/Linux

EDIT 2:

Changed the default kernel loglevel to 6 in the grub configuration, logs after boot indicating loglevel is explicitly set:

dmesg -l info
[    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-6.9.3-gentoo root=PARTUUID=4a5f5d65-81be-e24d-bedc-aeb2f0b24295 ro loglevel=6 i8042.nopnp mmio_stale_data=full libata.noacpi=1 resume=PARTUUID=c302ea25-d8e2-064e-8ebd-c79276fad2cc drm.edid_firmware=edid/1920x1080_BOE08E8.bin nvidia-drm.modeset=1

But still the issue persists, I don't see any kernel logs corresponding to info loglevel.

Suprisingly, the loglevel is actually not set,

If I do a cat /proc/sys/kernel/printk, I see the following output,

1       4       1       7

The default log level indicated by the first integer in the above output is still 1.

2 Answers 2

1

Kernel logs are sent to /proc/kmsg. Defining a new source on this file and redirecting those logs to a custom destination solved the issue.

source kern_src { file("/proc/kmsg"); };
filter kern_f { level(debug..emerg) and facility(kern); };
destination kern_dst { file("/var/log/kern.log"); };
log { source(kern_src); filter(kern_f); destination(kern_dst); };

Updated syslog-ng config file from the one posted in the question.

    @version: 4.7
#
# Syslog-ng default configuration file for Gentoo Linux

# https://bugs.gentoo.org/426814
@include "scl.conf"

options {
    threaded(yes);
    chain_hostnames(no);

    # The default action of syslog-ng is to log a STATS line
    # to the file every 10 minutes.  That's pretty ugly after a while.
    # Change it to every 12 hours so you get a nice daily update of
    # how many messages syslog-ng missed (0).
    stats(freq(43200));
    # The default action of syslog-ng is to log a MARK line
    # to the file every 20 minutes.  That's seems high for most
    # people so turn it down to once an hour.  Set it to zero
    # if you don't want the functionality at all.
    mark_freq(3600);
};

source src { system(); internal(); };
source kern_src { file("/proc/kmsg"); };

destination messages { file("/var/log/messages"); };
destination kern_dst { file("/var/log/kern.log"); };
destination auth_dst { file("/var/log/auth.log"); };
destination mail_dst { file("/var/log/mail.log"); };

filter kern_f { level(debug..emerg) and facility(kern); };
filter auth_f { level(debug..emerg) and facility(auth) and facility(authpriv); };
filter mail_f { level(debug..emerg) and facility(mail); };
filter default_f { level(debug..emerg) and not (facility(mail)) and not (facility(auth)) and not (facility(kern)); };

# By default messages are logged to tty12...
destination console_all { file("/dev/tty12"); };
# ...if you intend to use /dev/console for programs like xconsole
# you can comment out the destination line above that references /dev/tty12
# and uncomment the line below.
#destination console_all { file("/dev/console"); };

log { source(src); filter(default_f); destination(messages); };
log { source(src); filter(auth_f); destination(auth_dst); };
log { source(src); filter(kern_f); destination(kern_dst); };
log { source(src); filter(mail_f); destination(mail_dst); };
log { source(kern_src); filter(kern_f); destination(kern_dst); };
log { source(src); destination(console_all); };
2
  • You are using both the system() source and a separate /proc/kmsg source, which will both read the kernel logs (the system() driver does both /dev/log and /proc/kmsg). But there's one important thing to notice: the kernel /proc/kmsg driver does not like when two separate threads are reading it, potentially causing processes being blocked. The real solution is to let the system() driver take care of it and set your filters so that kernel logs are routed properly.
    – bazsi77
    Commented Jun 16 at 9:38
  • @bazsi77 system() driver is not outputting the /proc/kmsg in my machine. With the default configuration, I don't see any kernel logs. Hence, the explicit source definition. Two threads reading cannot cause process blocking. Why would it !? Commented Jun 18 at 13:34
0

Maybe sysklogd sets the kernel logging level automatically, whereas syslog-ng does not.

https://linuxconfig.org/introduction-to-the-linux-kernel-log-levels

You can reconfigure those in /proc/sys/kernel/printk

klogd does seem to adjust kernel logging levels: https://linux.die.net/man/8/klogd

2
  • Yes, syslog-ng does not set it explicitly. Hence, the reason that I have set it manually as shown above in the config file. Commented Jun 9 at 13:35
  • Even though I have explicitly changed the default kernel log level to 6, I don't see any change and the issue still persists. Refer to the edit for more details. Commented Jun 9 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .