How to get Lirem 5 kernel log in /var/log/syslog in addition to systemd journal?

Hardware Librem 5
1

On a Librem 13 running PureOS byzantium, kernel log messages appear in two places:

  • in the systemd journal, viewable using the journalctl command
  • in the /var/log/syslog file

It seems to work like that on some other Debian-based systems also, log messages from the kernel can be viewed using journalctl but are also available in the /var/log/syslog file.

However, on the Librem 5 running PureOS byzantium, there is no /var/log/syslog file, so it seems the only way to view kernel log messages is to go via systemd using the journalctl command.

I would like to change it so that things are logged to /var/log/syslog also, in the same way as on the Librem 13. How can this be done?

The reason I want this is that under some circumstances the phone suddenly turns itself off and after starting it again there are no clues in the log shown by sudo journalctl. My hope is that if kernel log messages can be logged directly to file instead of going via systemd, then maybe some kernel message could be written to /var/log/syslog before the sudden shutdown even if it was not recorded in the systemd journal. I’m thinking that could happen if systemd tried to be clever, perhaps buffering the message in memory to write it do disk later to save resources, then it could happen that the phone shut down before systemd got around to writing the log message to file. Then it would be better to have the kernel write the log directly without involving systemd.

So: is it possible to get kernel log messages written to file directly without involving systemd?

Any other suggestions about how to debug when the device seems to suddenly turn itself off?

Edit: trying to clarify what I mean by the device suddenly turning itself off, the behavior seem to be like what happens when the charger is not connected and you just suddenly pull out the battery: it just dies without any explanation seen in any log file, probably because the power just disappears suddenly, the kernel then never has any chance to do anything about it. The problem I want to investigate is that the phone seems to turn itself off in that way, as if the battery had been removed, but the battery was not removed so the question is why did it really shut down. Maybe the kernel was involved but the device shut down so quickly that the relevant kernel log messages were not yet written to disk. Then I would like to have kernel log messages written to file as quickly as possible, to increase the chances of getting some info saved to file about what happened before the device dies.

2

man journald.conf
ForwardToSyslog

?

But that might require also configuring a syslog daemon; and that still presumably involves systemd; and the man page suggests that ForwardToSyslog is default, so perhaps that means that you don’t have a syslog daemon.

1 Like
3

Thanks! You are right, the /var/log/syslog file appeared after I installed the rsyslog package like this:

sudo apt install rsyslog

After that, the log messages are both in /var/log/syslog and the systemd journal, in the same way as on the Librem 13.

Unfortunately it does not seem to help with the sudden power-off problem, /var/log/syslog just contains the same messages as the systemd journal, still no clues to why it powered itself off. The issue I wanted to investigate is this one: https://source.puri.sm/Librem5/linux-next/-/issues/337

4

Cool. You probably should mark either my post or your post as “solution”, in case someone else wonders the same thing. (Really it is only the two posts together that provide the full information needed to answer the original question.)

While we are on the subject of logging, I note that out-of-the-box the Librem 5 is not ever cleaning up the journal, which for me meant that tracking anything down in the journal was tediously slow. So I changed the configuration to do at least some cleaning.

In case it helps anyone else: sudo journalctl --disk-usage
will show that the journal is getting BIG. Edit /etc/systemd/journald.conf and set SystemMaxUse and/or MaxFileSec in accordance with your wishes.

And to tie the two issues together, I would suppose that if you are copying logs to syslog then the above control over the journal will only address half the problem and you would need to check that syslog log rotation is correctly happening, and that appears to occur daily via a systemd timer and service.

Yes, I understood that this question was only a means to an end. Unfortunately I can’t provide any useful info on that.

All I can say is that I have had essentially zero occurrences of sudden power-off. Once or twice in six months I have failed to get on charge in time (an easy mistake to make) and it has either shut itself down (after issuing the warning messages and illuminating the blue LED) or it has just run out of power and died. I would not consider that unexpected behaviour though. :wink:

2 Likes