ramlog - keeping logs in ram - any experience stories?

drakosha · 2008-07-31 09:16:31

I'm talking about this: http://freshmeat.net/projects/ramlog/
Any experience in Arch?

muczyjoe · 2008-08-11 06:56:58

Don't use the PKGBUILD posted above!
It doesn't stop the ramlog service on shutdown.
I've created a fixed PKGBUILD here: http://aur.archlinux.org/packages.php?ID=19031

drakosha · 2008-08-11 09:01:06

hm.. there's no pkgbuild listed above
so, is it that good?

muczyjoe · 2008-08-11 09:04:31

Yes, I've deleted it.
I'm using it now, and it seems to work, but be careful!

loserMcloser · 2008-08-12 04:15:56

Hmmm, I keep logs in ram but just use a simple /etc/rc.d/ script I threw together:

/etc/rc.d/tmpvarlog

#!/bin/bash

. /etc/rc.conf
. /etc/rc.d/functions

case "$1" in
  start)
    stat_busy "Setting Up /var/log"
    mkdir /tmp/var_log
    /usr/bin/rsync --archive --delete /var/log/ /tmp/var_log
    /bin/mount --bind /tmp/var_log /var/log
    add_daemon tmpvarlog
    stat_done
    ;;
  stop)
    stat_busy "Saving /var/log To Disk"
    /bin/umount /var/log
    /usr/bin/rsync --archive --delete /tmp/var_log/ /var/log
    rm -rf /tmp/var_log
    rm_daemon tmpvarlog
    stat_done
    ;;
  restart)
    $0 stop
    sleep 1
    $0 start
    ;;
  *)
    echo "usage: $0 {start|stop|restart}"
esac
exit 0

I have a tmpfs mounted on /tmp at boot using an appropriate entry in /etc/fstab, and the log files go into /tmp/var_log on startup and are sync'd back into /var/log on shutdown. Make sure you put the tmpvarlog daemon before syslog-ng or metalog or whatever in the daemons array in /etc/rc.conf.

muczyjoe · 2008-08-12 07:11:15

Well, the init script doesn't seem to work, but the little script, posted by loserMcloser is quite nice, so we should use that instead, I think...

senjin · 2008-08-26 13:43:41

...so, is the ramlog package from aur (1.1.0-1) working properly?

and where to set the "kernel option ramdisk_size=80000"?

muczyjoe · 2008-08-26 13:46:02

1. no
2. kernel commandline (menu.lst)
Once again: it isn't working properly!!

senjin · 2008-08-26 17:05:47

Thanks

And what about loserMcloser's script? It looks ok... and if I understand it correctly it doesn't use ramlog at all? Of course it requires me to set up the ram disk myself.

Last edited by senjin (2008-08-26 17:06:52)

muczyjoe · 2008-08-26 17:28:11

I use it since, he wrote here. No problem at all.

Profjim · 2008-08-26 22:27:42

To loserMcloser's script, shouldn't we add a "killall -HUP /usr/sbin/syslog-ng" after the mount command, to tell syslog to start using the new scripts? Other logging programs might also need to be notified...check your /etc/logrotate.conf and /etc/logrotate.d/* for clues as to which.

Similarly, there should be a killall -HUP... in the stop block, just before the rm -rf...

muczyjoe · 2008-08-27 05:22:34

Just as loserMcloser said: "Make sure you put the tmpvarlog daemon before syslog-ng or metalog or whatever in the daemons array in /etc/rc.conf."
So, syslog, etc... isn't running when tmpvarlog starts, and also, at shutdown, tmpvarlog is the last, who shuts down.

Last edited by muczyjoe (2008-08-27 05:23:31)

mfa · 2008-08-27 12:17:11

I am using loserMcloser's script and I the tmpvarlog is the first "daemon" in the list. However, I am getting "umount: /var/log is busy" messages when shutting down.

Has anybody else similar issues?

Cheers,
mfa

faw · 2008-09-01 21:24:55

mfa wrote:

I am getting "umount: /var/log is busy" messages when shutting down.

I am not running this script, but have had this error 'umount: /directory is busy' in the past. I worked out that it was because I had another partition mounted within my home partition. Do you have something mounted within /var/log?

Cheers,

mfa · 2008-09-03 14:09:26

faw wrote:

Do you have something mounted within /var/log?

Nope, this is my mount output:

mfa@phobos ~> mount
/dev/sda1 on / type reiserfs (rw,noatime,nodiratime)
none on /dev type ramfs (rw)
none on /proc type proc (rw)
none on /sys type sysfs (rw)
none on /dev/pts type devpts (rw,noatime)
none on /dev/shm type tmpfs (rw,noatime)
none on /tmp type tmpfs (rw,noatime,nodiratime)
/dev/mapper/home on /home type reiserfs (rw,noatime,nodiratime)
/tmp/varlog on /var/log type none (rw,bind)

I have put a "sleep 2" before the umont command and now the message appears less often. But I must say that this is annoying, because the logs are not saved, when this happens.

Cheers,
mfa

apaige · 2008-09-04 07:23:13

If you're running HAL, specify acpid and dbus explicitely in DAEMONS=() *after* tmpvarlog, *before* hal. I had the same problem with a similar tmpfs script, solved by running acpid and dbus explicitely. For some reason they were getting shut down in parallel or something, and the tmpfs script was getting called on shutdown before them.

senjin · 2008-09-07 15:49:53

I have managed to get loserMcloser's script running. However I noticed strange effect: After some time (running some programs) there appears about 32MB data in my swap. This is about the size of my /var/log. I rarely use more than half of my 1GB RAM, so I suspect, that maybe the disk buffers are pushing the tmpfs into swap? That would make no sense of running tmpvar log... However I don't know how to check it for sure.

I set my tmpfs by adding the following line to fstab:
tmpfs /tmp tmpfs rw
Is it ok?

Also I think that it would be safe to save the logs on disk hourly. How to do that?

lilsirecho · 2008-09-07 16:33:36

I use Faunos as my desktop system. It runs a "Live" system in tmpfs-ram.

I find that the tmpfs limits have an effect on performance of the system. These limits were set by the Faunos system initially.

I modified those limits with the following in /etc/rc.local..........

..... mount -o remount,size=3G /...........

This entry has aided other users to resolve interface problems in Faunos, even those with less than 3G of ram.

Tmpfs ram normally utilizes swap when its programmed limit is exceeded...as opposed to ramfs which is limited to one-half of physical ram.

So you may get some positive results from changing the tmpfs limits.

Good luck!

loserMcloser · 2008-09-08 05:06:25

senjin wrote:

I have managed to get loserMcloser's script running. However I noticed strange effect: After some time (running some programs) there appears about 32MB data in my swap. This is about the size of my /var/log. I rarely use more than half of my 1GB RAM, so I suspect, that maybe the disk buffers are pushing the tmpfs into swap? That would make no sense of running tmpvar log... However I don't know how to check it for sure.
I set my tmpfs by adding the following line to fstab:
tmpfs /tmp tmpfs rw
Is it ok?

I think lilsirecho is right -- the default size for tmpfs is too small for your logs and it is getting filled up and pushed to swap. You can specify the size for your tmpfs in fstab. Here is my fstab entry:

tmpfs           /tmp            tmpfs   defaults,noatime,size=2G

It's quite large for me (2 gigs) because I like to use it for various tasks besides just storing logs (ram is obviously much faster than hard drive). Though I actually only have 1 gig of ram, so anything over that starts using (very slow) swap.

senjin wrote:

Also I think that it would be safe to save the logs on disk hourly. How to do that?

Make some directory like /var/log_hourly and set up a cron job to do

/usr/bin/rsync --archive --delete /var/log/ /var/log_hourly

every hour.

mfa wrote:

I am using loserMcloser's script and I the tmpvarlog is the first "daemon" in the list. However, I am getting "umount: /var/log is busy" messages when shutting down.

Maybe try putting

[ $? -ne 0 ] && lsof | grep "/var/log" > /var/what_the_hell_is_blocking_my_umount

after the umount command in the script. Then the next time it happens, the contents of the file /var/what_the_hell_is_blocking_my_umount will tell you what program is causing /var/log to be busy.

Or another option is to put a loop around the umount command, and have it sleep and then try again if the umount fails. The only danger with this is that your machine will never shutdown if the program that is causing /var/log to be busy doesn't release /var/log.

Last edited by loserMcloser (2008-09-08 05:16:05)

senjin · 2008-09-08 09:14:08

loserMcloser wrote:

Here is my fstab entry:
tmpfs           /tmp            tmpfs   defaults,noatime,size=2G
It's quite large for me (2 gigs) because I like to use it for various tasks besides just storing logs (ram is obviously much faster than hard drive). Though I actually only have 1 gig of ram, so anything over that starts using (very slow) swap.

Thank you!
I guess setting "100M" will work fine?

loserMcloser wrote:

senjin wrote:
Also I think that it would be safe to save the logs on disk hourly. How to do that?
Make some directory like /var/log_hourly and set up a cron job to do
/usr/bin/rsync --archive --delete /var/log/ /var/log_hourly
every hour.

Right, but this is only backup... In case of system crash I would have two versions of logs in /var/log and /var/log_hourly...
I think about adding

rm -r /var/log_hourly

to tmvarlog "stop" section
and adding to the "start"

if [ -e /var/log_hourly ]
then
  /usr/bin/rsync --archive --delete /var/log_hourly/ /tmp/var_log
else
  /usr/bin/rsync --archive --delete /var/log/ /tmp/var_log
fi

Is it correct?

loserMcloser · 2008-09-09 05:11:50

senjin wrote:

I guess setting "100M" will work fine?

Depends on how quickly your logs increase in size, how long your typical uptime is, what your logrotate settings are ....

But for typical everyday use 100M should be more than enough.

senjin wrote:

I think about adding
...
to tmvarlog "stop" section
and adding to the "start"
...
Is it correct?

Maybe it should be

if [ -e /var/log_hourly ]
then
  /usr/bin/rsync --archive --delete /var/log_hourly/ /tmp/var_log
else
  /usr/bin/rsync --archive --delete /var/log/ /tmp/var_log
  /bin/mkdir /var/log_hourly
fi

?

senjin · 2008-09-09 07:59:09

loserMcloser wrote:

if [ -e /var/log_hourly ]
then
  /usr/bin/rsync --archive --delete /var/log_hourly/ /tmp/var_log
else
  /usr/bin/rsync --archive --delete /var/log/ /tmp/var_log
  /bin/mkdir /var/log_hourly
fi

I'm not sure. In case of system crash before the first cron execution this would leave empty /var/log_hourly. This - in turn - would cause deleting /var/log during the next tmpvarlog start.

Also it would be good if cron job checked whether tmpvarlog is running... but how to do it?

senjin · 2008-09-22 08:00:23

Ok, finally I modified the tmpvarlog following way:

#!/bin/bash

. /etc/rc.conf
. /etc/rc.d/functions

case "$1" in
  start)
    /bin/mkdir /tmp/var_log
    if [ -e /var/log_hourly ]
    then
      stat_busy "Recovering /var/log from /var/log_hourly"
      /usr/bin/rsync --archive --delete /var/log_hourly/ /tmp/var_log
    else
      stat_busy "Setting up /var/log"
      /usr/sbin/logrotate /etc/logrotate.conf
      /usr/bin/rsync --archive --delete /var/log/ /tmp/var_log
    fi
    /bin/mount --bind /tmp/var_log /var/log
    /bin/touch /var/log/.tmpvarlock
    add_daemon tmpvarlog
    stat_done
    ;;
  stop)
    stat_busy "Saving /var/log To Disk"
    /bin/rm /var/log/.tmpvarlock
    sleep 1
    /bin/umount /var/log 2> /dev/null
    if [ $? -eq "0" ]
    then
      /usr/bin/rsync --archive --delete /tmp/var_log/ /var/log
      /bin/rm -rf /var/log_hourly
    else
      /bin/mkdir /var/log_hourly 2> /dev/null
      /usr/bin/rsync --archive --delete /tmp/var_log/ /var/log_hourly
    fi
    rm -rf /tmp/var_log
    rm_daemon tmpvarlog
    stat_done
    ;;
  restart)
    $0 stop
    sleep 1
    $0 start
    ;;
  *)
    echo "usage: $0 {start|stop|restart}"
esac
exit 0

I have also created executable /etc/cron.hourly/tmpvarlog_backup:

#!/bin/sh
if [ -e /var/log/.tmpvarlock ]
then
  /bin/mkdir /var/log_hourly 2> /dev/null
  /usr/bin/rsync --archive --delete /tmp/var_log/ /var/log_hourly
  /bin/rm -f /var/log_hourly/.tmpvarlock
fi

1. In case of system crash I lose maximum 1 hour of logs.

2. In case of problems with umounting I don't lose the logs. At least I don't lose the logs from the time between tmvarlog start and stop. I think that some logs are written before the first daemon starts (for example dmesg in rc.sysinit, maybe something else also?), that logs are overwritten with /var/log_hourly in case of recovering logs.

Probably tmpvarlog is started to lately. Maybe it should be started at the beginning of rc.sysinit? I don't know.

3. There is no reason to keep logrotated logs in ram. You can add option "olddir /var/log_archive" to your logrotate.conf. You also have to create the /var/log_archive and manually move the logrotated logs for the first time. I have also removed "noolddir" option from /etc/logrotate.d/slim.

Unfortunately "olddir" works only when both log, and archive directories are on the same physical device; so it can't work when /var/log is mounted in tmpfs. You have to remove logrotate from crontab. It can be executed only before mounting (as I did in my tmpvarlog) or after umounting. Obviously this is not a solution for computers that are turned on for many days, because logrotate is executed only during booting or shutdown.

Last edited by senjin (2008-09-22 08:21:47)

Arch Linux

#1 2008-07-31 09:16:31

ramlog - keeping logs in ram - any experience stories?

#2 2008-08-11 06:56:58

Re: ramlog - keeping logs in ram - any experience stories?

#3 2008-08-11 09:01:06

Re: ramlog - keeping logs in ram - any experience stories?

#4 2008-08-11 09:04:31

Re: ramlog - keeping logs in ram - any experience stories?

#5 2008-08-12 04:15:56

Re: ramlog - keeping logs in ram - any experience stories?

#6 2008-08-12 07:11:15

Re: ramlog - keeping logs in ram - any experience stories?

#7 2008-08-26 13:43:41

Re: ramlog - keeping logs in ram - any experience stories?

#8 2008-08-26 13:46:02

Re: ramlog - keeping logs in ram - any experience stories?

#9 2008-08-26 17:05:47

Re: ramlog - keeping logs in ram - any experience stories?

#10 2008-08-26 17:28:11

Re: ramlog - keeping logs in ram - any experience stories?

#11 2008-08-26 22:27:42

Re: ramlog - keeping logs in ram - any experience stories?

#12 2008-08-27 05:22:34

Re: ramlog - keeping logs in ram - any experience stories?

#13 2008-08-27 12:17:11

Re: ramlog - keeping logs in ram - any experience stories?

#14 2008-09-01 21:24:55

Re: ramlog - keeping logs in ram - any experience stories?

#15 2008-09-03 14:09:26

Re: ramlog - keeping logs in ram - any experience stories?

#16 2008-09-04 07:23:13

Re: ramlog - keeping logs in ram - any experience stories?

#17 2008-09-07 15:49:53

Re: ramlog - keeping logs in ram - any experience stories?

#18 2008-09-07 16:33:36

Re: ramlog - keeping logs in ram - any experience stories?

#19 2008-09-08 05:06:25

Re: ramlog - keeping logs in ram - any experience stories?

#20 2008-09-08 09:14:08

Re: ramlog - keeping logs in ram - any experience stories?

#21 2008-09-09 05:11:50

Re: ramlog - keeping logs in ram - any experience stories?

#22 2008-09-09 07:59:09

Re: ramlog - keeping logs in ram - any experience stories?

#23 2008-09-22 08:00:23

Re: ramlog - keeping logs in ram - any experience stories?

Board footer