You are not logged in.
I'm talking about this: http://freshmeat.net/projects/ramlog/
Any experience in Arch?
Offline
Don't use the PKGBUILD posted above!
It doesn't stop the ramlog service on shutdown.
I've created a fixed PKGBUILD here: http://aur.archlinux.org/packages.php?ID=19031
Offline
hm.. there's no pkgbuild listed above
so, is it that good?
Offline
Yes, I've deleted it.
I'm using it now, and it seems to work, but be careful!
Offline
Hmmm, I keep logs in ram but just use a simple /etc/rc.d/ script I threw together:
/etc/rc.d/tmpvarlog
#!/bin/bash
. /etc/rc.conf
. /etc/rc.d/functions
case "$1" in
start)
stat_busy "Setting Up /var/log"
mkdir /tmp/var_log
/usr/bin/rsync --archive --delete /var/log/ /tmp/var_log
/bin/mount --bind /tmp/var_log /var/log
add_daemon tmpvarlog
stat_done
;;
stop)
stat_busy "Saving /var/log To Disk"
/bin/umount /var/log
/usr/bin/rsync --archive --delete /tmp/var_log/ /var/log
rm -rf /tmp/var_log
rm_daemon tmpvarlog
stat_done
;;
restart)
$0 stop
sleep 1
$0 start
;;
*)
echo "usage: $0 {start|stop|restart}"
esac
exit 0
I have a tmpfs mounted on /tmp at boot using an appropriate entry in /etc/fstab, and the log files go into /tmp/var_log on startup and are sync'd back into /var/log on shutdown. Make sure you put the tmpvarlog daemon before syslog-ng or metalog or whatever in the daemons array in /etc/rc.conf.
Offline
Well, the init script doesn't seem to work, but the little script, posted by loserMcloser is quite nice, so we should use that instead, I think...
Offline
...so, is the ramlog package from aur (1.1.0-1) working properly?
and where to set the "kernel option ramdisk_size=80000"?
Offline
1. no
2. kernel commandline (menu.lst)
Once again: it isn't working properly!!
Offline
Thanks
And what about loserMcloser's script? It looks ok... and if I understand it correctly it doesn't use ramlog at all? Of course it requires me to set up the ram disk myself.
Last edited by senjin (2008-08-26 17:06:52)
Offline
I use it since, he wrote here. No problem at all.
Offline
To loserMcloser's script, shouldn't we add a "killall -HUP /usr/sbin/syslog-ng" after the mount command, to tell syslog to start using the new scripts? Other logging programs might also need to be notified...check your /etc/logrotate.conf and /etc/logrotate.d/* for clues as to which.
Similarly, there should be a killall -HUP... in the stop block, just before the rm -rf...
Offline
Just as loserMcloser said: "Make sure you put the tmpvarlog daemon before syslog-ng or metalog or whatever in the daemons array in /etc/rc.conf."
So, syslog, etc... isn't running when tmpvarlog starts, and also, at shutdown, tmpvarlog is the last, who shuts down.
Last edited by muczyjoe (2008-08-27 05:23:31)
Offline
I am using loserMcloser's script and I the tmpvarlog is the first "daemon" in the list. However, I am getting "umount: /var/log is busy" messages when shutting down.
Has anybody else similar issues?
Cheers,
mfa
Offline
I am getting "umount: /var/log is busy" messages when shutting down.
I am not running this script, but have had this error 'umount: /directory is busy' in the past. I worked out that it was because I had another partition mounted within my home partition. Do you have something mounted within /var/log?
Cheers,
Offline
Do you have something mounted within /var/log?
Nope, this is my mount output:
mfa@phobos ~> mount
/dev/sda1 on / type reiserfs (rw,noatime,nodiratime)
none on /dev type ramfs (rw)
none on /proc type proc (rw)
none on /sys type sysfs (rw)
none on /dev/pts type devpts (rw,noatime)
none on /dev/shm type tmpfs (rw,noatime)
none on /tmp type tmpfs (rw,noatime,nodiratime)
/dev/mapper/home on /home type reiserfs (rw,noatime,nodiratime)
/tmp/varlog on /var/log type none (rw,bind)
I have put a "sleep 2" before the umont command and now the message appears less often. But I must say that this is annoying, because the logs are not saved, when this happens.
Cheers,
mfa
Offline
If you're running HAL, specify acpid and dbus explicitely in DAEMONS=() *after* tmpvarlog, *before* hal. I had the same problem with a similar tmpfs script, solved by running acpid and dbus explicitely. For some reason they were getting shut down in parallel or something, and the tmpfs script was getting called on shutdown before them.
Offline
I have managed to get loserMcloser's script running. However I noticed strange effect: After some time (running some programs) there appears about 32MB data in my swap. This is about the size of my /var/log. I rarely use more than half of my 1GB RAM, so I suspect, that maybe the disk buffers are pushing the tmpfs into swap? That would make no sense of running tmpvar log... However I don't know how to check it for sure.
I set my tmpfs by adding the following line to fstab:
tmpfs /tmp tmpfs rw
Is it ok?
Also I think that it would be safe to save the logs on disk hourly. How to do that?
Offline
I use Faunos as my desktop system. It runs a "Live" system in tmpfs-ram.
I find that the tmpfs limits have an effect on performance of the system. These limits were set by the Faunos system initially.
I modified those limits with the following in /etc/rc.local..........
..... mount -o remount,size=3G /...........
This entry has aided other users to resolve interface problems in Faunos, even those with less than 3G of ram.
Tmpfs ram normally utilizes swap when its programmed limit is exceeded...as opposed to ramfs which is limited to one-half of physical ram.
So you may get some positive results from changing the tmpfs limits.
Good luck!
Prediction...This year will be a very odd year!
Hard work does not kill people but why risk it: Charlie Mccarthy
A man is not complete until he is married..then..he is finished.
When ALL is lost, what can be found? Even bytes get lonely for a little bit! X-ray confirms Iam spineless!
Offline
I have managed to get loserMcloser's script running. However I noticed strange effect: After some time (running some programs) there appears about 32MB data in my swap. This is about the size of my /var/log. I rarely use more than half of my 1GB RAM, so I suspect, that maybe the disk buffers are pushing the tmpfs into swap? That would make no sense of running tmpvar log... However I don't know how to check it for sure.
I set my tmpfs by adding the following line to fstab:
tmpfs /tmp tmpfs rw
Is it ok?
I think lilsirecho is right -- the default size for tmpfs is too small for your logs and it is getting filled up and pushed to swap. You can specify the size for your tmpfs in fstab. Here is my fstab entry:
tmpfs /tmp tmpfs defaults,noatime,size=2G
It's quite large for me (2 gigs) because I like to use it for various tasks besides just storing logs (ram is obviously much faster than hard drive). Though I actually only have 1 gig of ram, so anything over that starts using (very slow) swap.
Also I think that it would be safe to save the logs on disk hourly. How to do that?
Make some directory like /var/log_hourly and set up a cron job to do
/usr/bin/rsync --archive --delete /var/log/ /var/log_hourly
every hour.
I am using loserMcloser's script and I the tmpvarlog is the first "daemon" in the list. However, I am getting "umount: /var/log is busy" messages when shutting down.
Maybe try putting
[ $? -ne 0 ] && lsof | grep "/var/log" > /var/what_the_hell_is_blocking_my_umount
after the umount command in the script. Then the next time it happens, the contents of the file /var/what_the_hell_is_blocking_my_umount will tell you what program is causing /var/log to be busy.
Or another option is to put a loop around the umount command, and have it sleep and then try again if the umount fails. The only danger with this is that your machine will never shutdown if the program that is causing /var/log to be busy doesn't release /var/log.
Last edited by loserMcloser (2008-09-08 05:16:05)
Offline
Here is my fstab entry:
tmpfs /tmp tmpfs defaults,noatime,size=2G
It's quite large for me (2 gigs) because I like to use it for various tasks besides just storing logs (ram is obviously much faster than hard drive). Though I actually only have 1 gig of ram, so anything over that starts using (very slow) swap.
Thank you!
I guess setting "100M" will work fine?
senjin wrote:Also I think that it would be safe to save the logs on disk hourly. How to do that?
Make some directory like /var/log_hourly and set up a cron job to do
/usr/bin/rsync --archive --delete /var/log/ /var/log_hourly
every hour.
Right, but this is only backup... In case of system crash I would have two versions of logs in /var/log and /var/log_hourly...
I think about adding
rm -r /var/log_hourly
to tmvarlog "stop" section
and adding to the "start"
if [ -e /var/log_hourly ]
then
/usr/bin/rsync --archive --delete /var/log_hourly/ /tmp/var_log
else
/usr/bin/rsync --archive --delete /var/log/ /tmp/var_log
fi
Is it correct?
Offline
I guess setting "100M" will work fine?
Depends on how quickly your logs increase in size, how long your typical uptime is, what your logrotate settings are ....
But for typical everyday use 100M should be more than enough.
I think about adding
...
to tmvarlog "stop" section
and adding to the "start"
...
Is it correct?
Maybe it should be
if [ -e /var/log_hourly ]
then
/usr/bin/rsync --archive --delete /var/log_hourly/ /tmp/var_log
else
/usr/bin/rsync --archive --delete /var/log/ /tmp/var_log
/bin/mkdir /var/log_hourly
fi
?
Offline
if [ -e /var/log_hourly ] then /usr/bin/rsync --archive --delete /var/log_hourly/ /tmp/var_log else /usr/bin/rsync --archive --delete /var/log/ /tmp/var_log /bin/mkdir /var/log_hourly fi
I'm not sure. In case of system crash before the first cron execution this would leave empty /var/log_hourly. This - in turn - would cause deleting /var/log during the next tmpvarlog start.
Also it would be good if cron job checked whether tmpvarlog is running... but how to do it?
Offline
Ok, finally I modified the tmpvarlog following way:
#!/bin/bash
. /etc/rc.conf
. /etc/rc.d/functions
case "$1" in
start)
/bin/mkdir /tmp/var_log
if [ -e /var/log_hourly ]
then
stat_busy "Recovering /var/log from /var/log_hourly"
/usr/bin/rsync --archive --delete /var/log_hourly/ /tmp/var_log
else
stat_busy "Setting up /var/log"
/usr/sbin/logrotate /etc/logrotate.conf
/usr/bin/rsync --archive --delete /var/log/ /tmp/var_log
fi
/bin/mount --bind /tmp/var_log /var/log
/bin/touch /var/log/.tmpvarlock
add_daemon tmpvarlog
stat_done
;;
stop)
stat_busy "Saving /var/log To Disk"
/bin/rm /var/log/.tmpvarlock
sleep 1
/bin/umount /var/log 2> /dev/null
if [ $? -eq "0" ]
then
/usr/bin/rsync --archive --delete /tmp/var_log/ /var/log
/bin/rm -rf /var/log_hourly
else
/bin/mkdir /var/log_hourly 2> /dev/null
/usr/bin/rsync --archive --delete /tmp/var_log/ /var/log_hourly
fi
rm -rf /tmp/var_log
rm_daemon tmpvarlog
stat_done
;;
restart)
$0 stop
sleep 1
$0 start
;;
*)
echo "usage: $0 {start|stop|restart}"
esac
exit 0
I have also created executable /etc/cron.hourly/tmpvarlog_backup:
#!/bin/sh
if [ -e /var/log/.tmpvarlock ]
then
/bin/mkdir /var/log_hourly 2> /dev/null
/usr/bin/rsync --archive --delete /tmp/var_log/ /var/log_hourly
/bin/rm -f /var/log_hourly/.tmpvarlock
fi
1. In case of system crash I lose maximum 1 hour of logs.
2. In case of problems with umounting I don't lose the logs. At least I don't lose the logs from the time between tmvarlog start and stop. I think that some logs are written before the first daemon starts (for example dmesg in rc.sysinit, maybe something else also?), that logs are overwritten with /var/log_hourly in case of recovering logs.
Probably tmpvarlog is started to lately. Maybe it should be started at the beginning of rc.sysinit? I don't know.
3. There is no reason to keep logrotated logs in ram. You can add option "olddir /var/log_archive" to your logrotate.conf. You also have to create the /var/log_archive and manually move the logrotated logs for the first time. I have also removed "noolddir" option from /etc/logrotate.d/slim.
Unfortunately "olddir" works only when both log, and archive directories are on the same physical device; so it can't work when /var/log is mounted in tmpfs. You have to remove logrotate from crontab. It can be executed only before mounting (as I did in my tmpvarlog) or after umounting. Obviously this is not a solution for computers that are turned on for many days, because logrotate is executed only during booting or shutdown.
Last edited by senjin (2008-09-22 08:21:47)
Offline