[rsyslog] kernel messages on usb flash drive

[david at lang.hm]

On Tue, 13 Jul 2010, Hongseok Cheon wrote:

> Hi everyone
>
>
> I want to write kernel meesage,which is generally recorded at
> /var/log/messages, at usb flash memory.
> It goes well when the kernel mesage recording file is specified on hard
> disk, but it does not on usb flash memory.
>
> What I have worked on is as below.
>
> --
>> mkdir /var/log/hm
>
>> mount /dev/sdb /var/log/hm
> (I checked that usb flash memory is mounted.)
>
>> vi /etc/rsyslog.conf
>
> I changed
> *.info;mail.none;authpriv.none;cron.none /var/log/messages
> to
> *.info;mail.none;authpriv.none;cron.none /var/log/hm/messages
> --
>
> When the kernel message recording place is specified on hard disk (such as
> /var/log/messages2), it records well. However, it does not record on usb
> flash memory

when you say it doesn't record on the USB flash, what is happening? do you 
get errors or do you find that the data is still written to the hard 
drive?

My guess is that it's being written to the hard drive because the USB 
stick is no mounted yet when rsyslog starts, so the file that it has open 
is on the hard drive and not the flash drive.

you need to start rsyslog after the flash drive is mounted, and then stop 
rsyslog before you unmount it to make sure the data is written to it.

David Lang