Mailing List Archive: rsyslog v8.2102 : can we use imklog module to read second kernel circular buffer

rsyslog v8.2102 : can we use imklog module to read second kernel circular buffer

Oct 29, 2022, 8:23 PM

Post #1 of 3 (289 views)

Hi

We have a kernel module that is exporting its logs to a separate
circular buffer via a debugfs file in the linux kernel. We were
wondering if we can use imklog to read that file and write the kernel
logs to a separate ext3/vfat file in userspace. Is that possible?

For imfile, I see we can provide input() blocks to read multiple
files. Didn't find something similar in documentation for imklog. Or
can we use the imfile module for our requirement? From the
documentation, I see imfile allows a user to specify a custom file to
read and attach a ruleset. Perhaps, we can use a ruleset

ruleset(name="remote") {
action(type="omfile" file="/home/persistent/kernel/module/fwd/traces")
}

to write the logs from the kernel debugfs file to a separate file.

Thank you
Prasad
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: rsyslog v8.2102 : can we use imklog module to read second kernel circular buffer [ In reply to ]

rsyslog at lists

Oct 29, 2022, 8:51 PM

Post #2 of 3 (289 views)

Permalink

I'm pretty sure that imklog doesn't currently have any provision to read
additional buffers, but I'm also pretty sure that a patch to enable that would
be accepted (or you could talk to Adiscon about sponsoring such a change)

unless you can show this to be a solution to a more general problem than just
your module, adding this feature is probably very low on the priority list.

David Lang

On Sat, 29 Oct 2022, Prasad Koya via rsyslog wrote:

> Hi
>
> We have a kernel module that is exporting its logs to a separate
> circular buffer via a debugfs file in the linux kernel. We were
> wondering if we can use imklog to read that file and write the kernel
> logs to a separate ext3/vfat file in userspace. Is that possible?
>
> For imfile, I see we can provide input() blocks to read multiple
> files. Didn't find something similar in documentation for imklog. Or
> can we use the imfile module for our requirement? From the
> documentation, I see imfile allows a user to specify a custom file to
> read and attach a ruleset. Perhaps, we can use a ruleset
>
> ruleset(name="remote") {
> action(type="omfile" file="/home/persistent/kernel/module/fwd/traces")
> }
>
> to write the logs from the kernel debugfs file to a separate file.
>
> Thank you
> Prasad
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: rsyslog v8.2102 : can we use imklog module to read second kernel circular buffer [ In reply to ]

rsyslog at lists

Oct 29, 2022, 11:54 PM

Post #3 of 3 (289 views)

Permalink

Thanks for the quick reply.

On Sat, Oct 29, 2022 at 8:51 PM David Lang <david@lang.hm> wrote:
>
> I'm pretty sure that imklog doesn't currently have any provision to read
> additional buffers, but I'm also pretty sure that a patch to enable that would
> be accepted (or you could talk to Adiscon about sponsoring such a change)
>
> unless you can show this to be a solution to a more general problem than just
> your module, adding this feature is probably very low on the priority list.
>
> David Lang
>
> On Sat, 29 Oct 2022, Prasad Koya via rsyslog wrote:
>
> > Hi
> >
> > We have a kernel module that is exporting its logs to a separate
> > circular buffer via a debugfs file in the linux kernel. We were
> > wondering if we can use imklog to read that file and write the kernel
> > logs to a separate ext3/vfat file in userspace. Is that possible?
> >
> > For imfile, I see we can provide input() blocks to read multiple
> > files. Didn't find something similar in documentation for imklog. Or
> > can we use the imfile module for our requirement? From the
> > documentation, I see imfile allows a user to specify a custom file to
> > read and attach a ruleset. Perhaps, we can use a ruleset
> >
> > ruleset(name="remote") {
> > action(type="omfile" file="/home/persistent/kernel/module/fwd/traces")
> > }
> >
> > to write the logs from the kernel debugfs file to a separate file.
> >
> > Thank you
> > Prasad
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> >
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.