All I can say is that rsyslog just calls the usual open() API. You may run it in debug mode to see what the OS returns when trying to open the file on the USB drive. From rsyslog's POV, all files are equal, no matter where they reside. Of course, this means the filesystem must be mounted (as David pointed out).
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Hongseok Cheon > Sent: Tuesday, July 13, 2010 6:50 AM > To: rsyslog-users > Subject: Re: [rsyslog] kernel messages on usb flash drive > > 2010/7/13 <[email protected]> > > > On Tue, 13 Jul 2010, Hongseok Cheon wrote: > > > > > Hi everyone > > > > > > > > > I want to write kernel meesage,which is generally recorded at > > > /var/log/messages, at usb flash memory. > > > It goes well when the kernel mesage recording file is specified on > hard > > > disk, but it does not on usb flash memory. > > > > > > What I have worked on is as below. > > > > > > -- > > >> mkdir /var/log/hm > > > > > >> mount /dev/sdb /var/log/hm > > > (I checked that usb flash memory is mounted.) > > > > > >> vi /etc/rsyslog.conf > > > > > > I changed > > > *.info;mail.none;authpriv.none;cron.none /var/log/messages > > > to > > > *.info;mail.none;authpriv.none;cron.none /var/log/hm/messages > > > -- > > > > > > When the kernel message recording place is specified on hard disk > (such > > as > > > /var/log/messages2), it records well. However, it does not record > on usb > > > flash memory > > > > when you say it doesn't record on the USB flash, what is happening? > > > > > > do you > > get errors or do you find that the data is still written to the hard > > drive? > > > ==> > I can see following message through 'dmesg' cmd. > SELinux: initialized (dev sdb1, type vfat), uses genfs_contexts > i don't know what the message means. > > I cannot find the data on the hard drive. > > > > > > > > > My guess is that it's being written to the hard drive because the USB > > stick is no mounted yet when rsyslog starts, so the file that it has > open > > is on the hard drive and not the flash drive. > > > > you need to start rsyslog after the flash drive is mounted, and then > stop > > rsyslog before you unmount it to make sure the data is written to it. > > > > ==> > after the usb stick is mounted, i restarted rsyslog. But nothing is > changed > T.T > > > when i try to write kenel messages to usb flash drive, > I can see kernel messages using 'dmesg' cmd, but they are not written > to > the flash drive or hard drive. > > > Cheon. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
