Final Call ... XenServer Boot Media
-
Why do you have a second array?
I'd just set up the Graylog virtual appliance and send the logs from XenServer to that.
-
What is the point of changing anything? USB Does not just die that fast. Take the time to setup a log server and change your logging.
-
XS still logs locally even if you send the logs elsewhere.
I was under the impression that constant writing to a USB would kill it pretty quickly.
-
@BRRABill said in Final Call ... XenServer Boot Media:
XS still logs locally even if you send the logs elsewhere.
I was under the impression that constant writing to a USB would kill it pretty quickly.
It just uses rsyslog. If you remove all of the local log info from /etc/rsyslog.conf it will only send to the remote server. You have to restart the rsyslog server after you do your edits.
-
@stacksofplates said
It just uses rsyslog. If you remove all of the local log info from /etc/rsyslog.conf it will only send to the remote server. You have to restart the rsyslog server after you do your edits.
I don't really want to get back into this (plenty of threads already) but In our testing of this, it was not the case.
XS rewrote the rsyslog.conf every time.
Are you using XS? Check yours. Did it rewrite it, or leave it as you wanted it?
-
@BRRABill said in Final Call ... XenServer Boot Media:
@stacksofplates said
It just uses rsyslog. If you remove all of the local log info from /etc/rsyslog.conf it will only send to the remote server. You have to restart the rsyslog server after you do your edits.
I don't really want to get back into this (plenty of threads already) but In our testing of this, it was not the case.
XS rewrote the rsyslog.conf every time.
Are you using XS? Check yours. Did it rewrite it, or leave it as you wanted it?
I'm not, I'm using KVM. But you can make that file immutable.
chatter +i /etc/rsyslog.confNot even root can modify that file until you remove the immutable flag.
-
According to this http://xenserver.org/discuss-virtualization/virtualization-blog/entry/log-rotation-and-syslog-forwarding.html
It's rewriting from /var/lib/syslog.conf. So changing there should keep the changes.
-
@BRRABill said in Final Call ... XenServer Boot Media:
My perceived downside with A and B is having to manually take the server down more often to make a clone. But this might only have to be done every few months, depending on the longevity of the USB stick.
And only as often as there are changes made.
-
@stacksofplates said in Final Call ... XenServer Boot Media:
Why do you have a second array?
I'd just set up the Graylog virtual appliance and send the logs from XenServer to that.
He did not get that to work.
-
@BRRABill said in Final Call ... XenServer Boot Media:
XS still logs locally even if you send the logs elsewhere.
I was under the impression that constant writing to a USB would kill it pretty quickly.
Can you show the entire configuration file for that situation?
-
@stacksofplates said in Final Call ... XenServer Boot Media:
@BRRABill said in Final Call ... XenServer Boot Media:
XS still logs locally even if you send the logs elsewhere.
I was under the impression that constant writing to a USB would kill it pretty quickly.
It just uses rsyslog. If you remove all of the local log info from /etc/rsyslog.conf it will only send to the remote server. You have to restart the rsyslog server after you do your edits.
This is important, XS uses rsyslog, the questions are purely ones about rsyslog, not XS. Don't think of this as how "XS behaves", it's just a matter of configuring rsyslog. It's identical to any OS that uses rsyslog.
-
@BRRABill said in Final Call ... XenServer Boot Media:
XS rewrote the rsyslog.conf every time.
Ah, I never saw that mentioned and that means that you were addressing the wrong thing. You needed to stop it changing rsyslog.conf. What did you do to stop it from doing that?
-
@scottalanmiller said in Final Call ... XenServer Boot Media:
@BRRABill said in Final Call ... XenServer Boot Media:
XS rewrote the rsyslog.conf every time.
Ah, I never saw that mentioned and that means that you were addressing the wrong thing. You needed to stop it changing rsyslog.conf. What did you do to stop it from doing that?
Nothing. I followed the instructions in the above mentioned article.
-
@BRRABill said in Final Call ... XenServer Boot Media:
Nothing. I followed the instructions in the above mentioned article.
That's a really old post from well before XS7 came out. According to this recent post by a Citrix employee, the proper file to be editing is /etc/rsyslog.d/xenserver.conf
-
@Danp said in Final Call ... XenServer Boot Media:
@BRRABill said in Final Call ... XenServer Boot Media:
Nothing. I followed the instructions in the above mentioned article.
That's a really old post from well before XS7 came out. According to this recent post by a Citrix employee, the proper file to be editing is /etc/rsyslog.d/xenserver.conf
According to that post, XS7 has logging turned off be default?
Or am I reading that wrong?
-
@BRRABill By default, the messages file isn't being used for the system logs.
-
@Danp said in Final Call ... XenServer Boot Media:
@BRRABill By default, the messages file isn't being used for the system logs.
But the logs themselves are still writing, correct?
So you think if I comment out the xenserver.conf file, that might maintain the changes?
-
@BRRABill said in Final Call ... XenServer Boot Media:
@scottalanmiller said in Final Call ... XenServer Boot Media:
@BRRABill said in Final Call ... XenServer Boot Media:
XS rewrote the rsyslog.conf every time.
Ah, I never saw that mentioned and that means that you were addressing the wrong thing. You needed to stop it changing rsyslog.conf. What did you do to stop it from doing that?
Nothing. I followed the instructions in the above mentioned article.
If this article isn't for doing what you want, why expect it to do something different than it is intended to do?
-
@BRRABill said in Final Call ... XenServer Boot Media:
@Danp said in Final Call ... XenServer Boot Media:
@BRRABill By default, the messages file isn't being used for the system logs.
But the logs themselves are still writing, correct?
So you think if I comment out the xenserver.conf file, that might maintain the changes?
If that is what Citrix says, then yes.
-
Just try editing that file, reboot and see.
