According to Kenneth Stephen: While burning my CPU.
>
> Richard Adams wrote:
>
> > According to Kenneth Stephen: While burning my CPU.
> > >
> > > Richard Adams wrote:
> > >
> > > > According to Nagle, Adrian: While burning my CPU.
> > > > >
> > > > > Reading through the /var/log/messages file, I've noticed that not everything
> > > > > that is displayed on the screen is logged in /var/log/messages. Are there
> > > > > other locations, or a way to redirect ALL the boot output to /var/log
> > > > > messages? I always see some sort of httpd error that cannot resolve my
> > > > > machine name but it does not show up in /var/log/messages.
> > > >
> > > > All system logs are controlled by /etc/syslog.conf take a look at it and
> > > > then do;
> > > > 'man syslog.conf'
> > > >
> > > > However program/daemon logs can be almost anywhere, the trend thesedays
> > > > is for daemons to have the error logs defined by the user, if your
> > > > http.conf is still default then it possably could be found in
> > > > /var/log/http/error_log
> > > >
> > >
> > > Adrian,
> > >
> > > I have to disagree with Richard on a technicality. The syslog mechanism will
> > > not capture ALL messages that are produced at boot time. It can only capture
> > > messages that are produced by the kernel. There are other boot messages that are
> > > produced at boot time by boot scripts are other programs. These do not get
> > > captured unless they explicitly use the sylog mechanism.
> > >
> > > AFAIK, there is only one way of capturing ALL such messages - by redirecting
> > > output to a file.
> >
> > I cant understand why you disagree Kenneth, you are correct about the kernel
> > messages, but that i explaned above /etc/syslog.conf. Your comment;
> >
> > "AFAIK, there is only one way of capturing ALL such messages
> > - by redirecting output to a file"
> >
> > That is exactly what i mean with /etc/syslog.conf and http.conf you do that
> > in those files.
> >
> > The issue here is a program being started at bootime, namely httpd, now in
> > /etc/httpd/conf (on a redhat system) there is a file called httpd.conf, in
> > this file we can direct the "error messages" produced at bootime or httpd's
> > starttme to a file called "logs/error_log" the directory log is a symbolic
> > link to /var/log/httpd/error_log.
> >
> > There are many other programs which allow the "user" to define where the
> > error messages go or to turn them off completly.
> >
> > My comment was;
> > if your http.conf is still default then it possably could be found in
> > /var/log/http/error_log
> >
> > Thats the default setting.
>
> Richard,
>
> I guess I misunderstood your reply. Part of Adrian's question was how to capture
> ALL boot-time messages, and I thought that you were implying that the syslog
> mechanism was capable of doing this.
Well i suppose it depends on what the definition of "ALL" is, at bootime up
untill "starting daemons:" the messages are all sent to the kernel ring
buffer which can be read with dmesg.
Note; dmesg will only show 4k's of text, this means if you do things like
mount other drives attach drivers or have any kernel problems, the orgiganal
text in dmesg will dissapier as other messages will be written to the bottom
of the buffer pushing the top (first messages) of the list.
One way of combating this is to put a line of text into /etc/rc.d/rc.local
just above the place before the "prompt" is called.
/bin/dmesg >/home/my_account/dmesg.start
Where my_account is your home directory.
Starting deamons, the point where dmesg stops and daemon/program logs take
over and write to seperate log files, which "can" be anywhere, daemons which
attach to the kernel for example send messages to the system log, its up to
the user to define what he wants to see in his system log(s) by defining the
defaults in /etc/syslog.conf. That may sound contradictory but if a daemon
or program does something to the kernel then that message possably will be
written twice, once to the syslog and once to its own log_file.
However things like httpd the daemon in question write to where ever the
"user" defines it to go, the default is log/error_log, there is normaly a
symlink pointing to /var/log/http/error_log on redhat systems.
I dont have httpd on my slackware machine so i cant say, i belive its also
/var/....
As to the origanal question, i suppose its still unanswerd as this is a work
around, one could say, however i think it explans the way the system logs
events, if anyone has any other comments please feel free to speak your
mind, as i do sometimes overlook some small details.
>
> Kenneth
>
> --
> There is no such thing as luck. 'Luck' is nothing but an absence of bad luck.
>
>
>
--
Regards Richard.
[EMAIL PROTECTED]
