https://bugzilla.novell.com/show_bug.cgi?id=663367 https://bugzilla.novell.com/show_bug.cgi?id=663367#c wei wang changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wewang@novell.com AssignedTo|bnc-team-screening@forge.pr |puzel@novell.com |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=663367 https://bugzilla.novell.com/show_bug.cgi?id=663367#c2 Elmar Stellnberger changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|estellnb@gmail.com | --- Comment #2 from Elmar Stellnberger 2011-01-12 11:14:21 UTC --- 1. If there was a crash: Certainly there often is; for several reasons: kernel oopses, crashes and hangs, Xorg event queue overflows & lifelocks, etc. (This is simply because Linux software is often tested by the end user.) 2. If there was a crash I want to report it to get it resolved. 3. If I want to report a crash I will be in need of the logfiles. 4. The most important logfiles like /var/log/messages and /var/log/warn are constantly destroyed as soon as you reboot into the system that just has crashed. This is because these files are newly created (overwritingly) on bootupup after kernel initialization (/var/log/boot.msg). They do and should only contain information related to a single boot-session (i.e. bootup-work-shutdown/crash). 5. A rescue system can help because it boots a system from CD without touching your hard drive so that everything in your /var partition will still stay in place. Simply mount it then and evacuate all you need on an USB-stick or to your home or another place in your var-partition. That`s it! Bad luck only if you don`t succeed to make your bios boot from CD instead of hdd in time. Then all the information is lost - and many bugs are hard to reproduce. Consequently: We need to create a backup of at least /var/log/messages and /var/log/warn right after kernel initialization but before these files are re-created overwriting their old ancestors. Reasonsing: The same happens with /var/log/boot.msg (logged during kernel initialization at the very beginning). It is automatically back-uped to /var/log/boot.omsg. Sameways /var/log/Xorg.0.log is backuped to /var/log/Xorg.0.log.old on X startup. For the logfiles created by rsyslogd (warn, messages & others) we will however have to initiate this by hand. RSysLogD simply does not do that (automatically) on its own. As far as I have questioned this by various people using other distros logrotate is assumed to do be conceived for that purpose. What needs to be done: The most challenging part of it will for sure be to call logrotate just before messages & warn are re-created. For that purpose it will be useful to configure logrotate appropriately (The configuration file for the current (not very sensful) cron-based logrotate invocation locates in /etc/logrotate.d/syslog); comparingly we can state: * Extending by date is not useful here, as a machine will typically crash multiple times per day (i.e. no dateext). * no compress: We want to view the logfiles of the current day by an editor of choice without having to unpack them. This is useful for a quick first hand error outlook or analysis. * I presmue that basically a rotate of 2 will suffice for most purposes. We don`t have more than one backup for Xorg.log and boot.msg as well. However you are free to let more being kept by default including additional packed hyperlogbackups tagged by date. reproduce by unplugging your power cable or just by pressing Alt-PrnScr-S-U-B. P.S.: The text above got sorrystandingly not very entendible because I have pressed commit by accident before being able to revise and correct it. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=663367 https://bugzilla.novell.com/show_bug.cgi?id=663367#c4 Dr. Werner Fink changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |mt@novell.com Resolution| |INVALID --- Comment #4 from Dr. Werner Fink 2011-01-13 10:30:31 UTC --- First of all, syslogd (not used as default logger on 11.3), nor syslog-ng, nor rsyslogd destroy log files. They only append to those file if already exist. IMHO this is due file system crash. That is that after the required file system check the files are removed or moved to lost+found. This has nothing todo with the system loggers. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.