3

I am using rsyslog, and I want to send logs to /dev/xconsole.

I have following relevant line in /etc/rsyslog.conf

*.*;cron.!=info;mail.!=info   |/dev/xconsole

This works only partially. It looks as if /dev/xconsole can only store cca 64kB. Once the buffer is full, new logs are lost

I have done following test:

1) add to `/etc/rsyslog.conf`
*.*;cron.!=info;mail.!=info    /tmp/aaa

2) reboot

3) cat /dev/xconsole > /tmp/bbb

4) diff /tmp/aaa /tmp/bbb

Now, aaa and bbb should be the same. But they are not. aaa contains complete logs, while bbb is missing 229 last lines

How can I fix this problem? Is the size of /dev/xconsole indeed limited ? Can I increase the size?

Improve this question
5
  • 2
    Something is supposed to read from /dev/xconsole from the moment you start logging. You need to start that cat /dev/xconsole before you start rsyslogd.
    – Gilles 'SO- stop being evil'
    Sep 13, 2015 at 22:08
  • @Gilles - I need the whole log output. I cannot discard it. Is it possible to increase the size of /dev/xconsole to 128 KB ?
    – Martin Vegter
    Sep 14, 2015 at 6:27
  • @Martin Vegter: The solution (of a real problem) is obvious: discard /dev/xconsole and log directly to file(s). Why do you seek adventures here?
    – Incnis Mrsi
    Sep 14, 2015 at 10:14
  • @IncnisMrsi. If you open a fifo with O_WRONLY, the open blocks (or fails (with ENXIO on Linux) for a non-blocking open) and the pipe is not instantiated until something opens in RDONLY or RDWR. On Linux, if you open with O_RDWR, the pipe is instantiated and you can start writing data to it. (which can be read by yourself (on that same fd where reading reads from the other end of the pipe) or other processes opening the fifo in RDONLY or RDWR mode).
    – Stéphane Chazelas
    Sep 14, 2015 at 12:55
  • @StéphaneChazelas: thanks for pointing out, which namely system call is blocked when nobody reads.
    – Incnis Mrsi
    Sep 14, 2015 at 13:00

1 Answer 1

Reset to default
1

Technically, /dev/xconsole has no size since it’s a named pipe a.k.a. . But the Linux kernel supplies each such object, when in use, with a buffer, 64 KiB (in Linux 3.x) or 4 KiB (in Linux 2.x). Not in the filesystem, only in memory. See https://stackoverflow.com/questions/4624071/pipe-buffer-size-is-4k-or-64k and https://unix.stackexchange.com/a/229544/80483 for more information.

If the application (xconsole) doesn’t read its data timely, then the buffer becomes full; syslog can’t write there and, avoiding to be blocked, drops messages.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .