System dataset / log files location?

[mortar]

The webgui has an option to choose the pool where system dataset is to be placed. From documentation I got the impression that older system log (kernel messages) would end up there as well. Where exactly can I find these older log files? I'm not seeing anything on my storage pool which I selected for the system dataset. Can't access it now due to another problem, but I'd remember there was a .freenas directory at the root level of the pool, but it only contained something that looked like temporary files of the first upgrade I ever did, which were all several months old.

 

[dlavigne]

From documentation I got the impression that older system log (kernel messages) would end up there as well. Where exactly can I find these older log files?

Regardless of the location of the system dataset, the log containing system/kernel messages is always found in /var/log/messages. If that file has been rotated for size, you'll see additional files named /var/log/messages.0.bz2 (the previous log), /var/log/messages.1.bz2 (the one before that), etc. The bz2 means it has been compressed, but you can use bzcat to unzip and read on the fly (eg bzcat /var/log/messages.1.bz2).

 

[mortar]

Regardless of the location of the system dataset, the log containing system/kernel messages is always found in /var/log/messages. If that file has been rotated for size, you'll see additional files named /var/log/messages.0.bz2 (the previous log), /var/log/messages.1.bz2 (the one before that), etc. The bz2 means it has been compressed, but you can use bzcat to unzip and read on the fly (eg bzcat /var/log/messages.1.bz2).

Thanks. I'm familiar with unix and generally know where the log files are and how to access them. However, I can only find logs (in the rotated bz2 files) reaching back a couple of months while older logs are nowhere to be found. So, let me ask a related question: where am I supposed to find the system dataset on my storage pool and what am I supposed to find there? I am asking this because I feel that for some reason the system dataset is maybe not written at all, or at least not to the storage pool as directed by the webgui config option.

 

[dlavigne]

The location (as far as the OS is concerned) is always /var/log. The system dataset knob merely indicates which pool (or collection of physical disks) to use when writing /var/log to physical disk blocks. Logs aren't kept forever as FreeBSD-based systems use newsyslog to rotate by size or time and to keep a set amount (count) of compressed logs as described in newsyslog.conf(5).

 

[mortar]

Ok, starting to get it. If I change the syslog config (supposing it has to be thru shell), will that be saved in the config db so that it can be restored with the rest of the config? I'd like it to keep the logs a bit farther back.

A while back, I saw some corruption because of a Marvell SATA controller, and the anomalies with the controller were rather rare, but visible in the syslog as well as as corruption in the fs. With only a few months of log, I might lose the rare log entries related to corruption before I notice that corruption has happened.

 

[dlavigne]

You're actually better off sending them to a syslog server for storage as this can be set in the GUI (though it assumes you have another Unix-like server in the network that is running syslog and that its rotation mechanism is configured as desired).

If you opt to edit the file manually on the FreeNAS system, it will not survive a reboot or update as it won't be written to the config database.

Another DIY option is to create a script that periodically copies the desired logs to another folder or system. You would want to include logic in the script to either rename the log (eg to include that day's date) or to perhaps tarball up the current logs and give the tarball a useful name (eg which includes the date). You could then add that script as a Cron Job in the GUI.

 

[mortar]

You're actually better off sending them to a syslog server for storage as this can be set in the GUI (though it assumes you have another Unix-like server in the network that is running syslog and that its rotation mechanism is configured as desired).

If you opt to edit the file manually on the FreeNAS system, it will not survive a reboot or update as it won't be written to the config database.

Another DIY option is to create a script that periodically copies the desired logs to another folder or system. You would want to include logic in the script to either rename the log (eg to include that day's date) or to perhaps tarball up the current logs and give the tarball a useful name (eg which includes the date). You could then add that script as a Cron Job in the GUI.

Thanks for the suggestions! Indeed, syslog server sounds like the cleanest option here and is do-able.