How does metalog work?

Elijah · n00b Joined: 19 Apr 2003 Posts: 29 Location: Philippines

I've read the intall guide and searched a few times on the forum and google, but this metalog thing is confusing me. My head hurts.
I want to be able to tail -f /var/log/messages (I figure that would be /var/log/everything/current on metalog) just like in syslog but it's not that 'realtime' as I expected. I tried "killall -USR1 metalog" and tailed the /var/log/everything/current but when I plug in my usb camera and my phone I get no messages from the kernel. How the heck does this work??

ctford0 · Posted: Sun Jun 01, 2003 4:50 am Post subject:

Metalog has a built in buffer to improve system performance. Honestly if your more comfortable with syslog then you should move to syslog-ng. The main reason, well although metalog is very easy to configure, it has been dead for sometime now. Notice the version number that you have isn't even at the 1.0 stage....

If you want to stick to metalog, just edit the file /etc/conf.d/metalog and just add a -s there like the file suggests. This will turn off buffering for good.

Chris

Elijah · n00b Joined: 19 Apr 2003 Posts: 29 Location: Philippines

hmmm, I've put the -s on:

Elijah · n00b Joined: 19 Apr 2003 Posts: 29 Location: Philippines

doh* it looks like I'm not getting any messages cause hotplugging isn't on, it's working fine now afterall, Thanks

But I'm still curious on how the buffering work?? :?:

ctford0 · Posted: Mon Jun 02, 2003 10:46 am Post subject:

Basically it keeps some of the newest messages in memory for a while so that it can prevent itself from writing to the hard disk all the time. With syslog and the like, you always have hard drive activity because as soon as it gets a message it writes it to a log file. metalogs buffer system stores the most recent logs, to be kinda simple here, in the ram and then when its ready writes it to the hard drive. This type of system can really help performance, however, its not good when you are trying to debug things such as a system crash because you cant see your most recent logs because they are actually stored in the ram....

Chris

Elijah · n00b Joined: 19 Apr 2003 Posts: 29 Location: Philippines

That sounds good, but is there a way to view those logs from the ram? :?:

ctford0 · Posted: Mon Jun 02, 2003 3:03 pm Post subject:

No, you just have to kill the buffer.....
adding the -s in /etc/conf.d/metlog

And the explaination of "storing logs in ram" was just for illustrative purposes only, it actually just stores the information not the actual log files. And it could also be some other location besides the ram??

Chris

Elijah · n00b Joined: 19 Apr 2003 Posts: 29 Location: Philippines

hmmm, I see...I should've picked syslog instead, oh well.. Thanks a lot ctford0!

Slynix · n00b Joined: 11 May 2003 Posts: 67

dunno if youv fixed it but this should be correct:

Elijah · n00b Joined: 19 Apr 2003 Posts: 29 Location: Philippines

It works just fine

but thanks anyway.