Log file

[Liz]

I would like to move the weewx log file entries to their own log
/var/log/weewx etc
I'm using the Debian package for 2.7.0 and Weewx fills up
my /var/log/messages

Has anyone already accomplished this and be prepared to share, or do I
need to make my own edits?

Liz

[mwall]

adjust the rsyslog config and restart rsyslogd:

sudo ln -s /etc/weewx/rsyslog.d/weewx.conf /etc/rsyslog.d/weewx.conf
sudo /etc/init.d/rsyslog stop
sudo /etc/init.d/rsyslog start

you will also want logrotate:

sudo ln -s /etc/weewx/logrotate.d/weewx /etc/logrotate.d/weewx

m

[Liz]

thankyou, accomplished.

[Liz]

On Sat, 13 Dec 2014 20:30:33 -0800 (PST)
mwall <mw...@users.sourceforge.net> wrote:

for completeness, I had to edit /etc/weewx/logrotate.d/weewx
uncommenting
create 644 root adm

and commenting
# create 644 syslog adm

as I had regular errors when cron daily ran

[Mark Hahn]

I followed these instructions and now I'm getting the log output in both /var/log and in syslog.  Can someone help?  If it would help I'll post all the various config files. 

 

[mwall]

On Thursday, April 23, 2015 at 6:10:10 PM UTC-4, Mark Hahn wrote:

I followed these instructions and now I'm getting the log output in both /var/log and in syslog.  Can someone help?  If it would help I'll post all the various config files. 

mark,

which operating system and version are you using?

m

[vince]

On Thursday, April 23, 2015 at 3:10:10 PM UTC-7, Mark Hahn wrote:

I followed these instructions and now I'm getting the log output in both /var/log and in syslog.  Can someone help?  If it would help I'll post all the various config files. 

 

Ummm - /var/log is a directory and syslog is a file, so I'm guessing you typo'd the problem description....

Which operating system ?   Which syslog variant ?  Which files do you see entries in ?  Do you see them always with debug=1 'and' debug=0  or just with one or the other ?

For discussion I'll assume you're on a Pi and using rsyslogd - in that case you're probably matching twice therefore getting two log entries - one specifically for weewx matching the program name (from the file you added to rsyslog.d), and one matching the facility.severity combination weewx logs with (from the default rsyslogd.conf).   I 'think' you need to add something to rsyslogd.conf to suppress the default logging.

The problem is that you still want *.info and *.debug (excluding weewx of course) logged normally, so commenting that out wouldn't be right.  Unfortunately I don't remember the exact syntax for how to do this with rsyslogd, but hopefully this points you toward one way to do it.  Google and Stackoverflow are two good sites to search.

[vince]

Matthew - is there a bug in the rsyslog file or in rsyslog perhaps ?

Why aren't the two lines ending with '~' stopping the processing to prevent the multiple matches ?

[mwall]

On Thursday, April 23, 2015 at 11:20:51 PM UTC-4, vince wrote:

Matthew - is there a bug in the rsyslog file or in rsyslog perhaps ?

Why aren't the two lines ending with '~' stopping the processing to prevent the multiple matches ?

i do not know.

i've seen this behavior before (weewx output goes to both /var/log/syslog and /var/log/weewx, even though there is a ~ rule) but i do not have an answer.

m

[Mark Hahn]

> which operating system and version are you using?

Ubuntu headless server with 14.04.

> /var/log is a directory and syslog is a file

That was lazy typing, sorry.  I meant /var/log/weewx.log and /var/log/syslog.

I was wrong about it logging to two places at once.  Sorry about the confusion.  What happened was that it logged to the file /var/log/weewx.log for a while and then at some point went back to logging to /var/log/syslog.  I saw both logs and didn't realize they weren't at the same time.

Now it is logging to /var/log/syslog and I can't get it back to /var/log/weewx.log.  So I still need help.

Here are the contents of my /etc/weewx/rsyslog.d/weewx.conf file ...

:programname,isequal,"weewx" /var/log/weewx.log
:programname,isequal,"weewx" ~
:programname,startswith,"wee_" /var/log/weewx.log
:programname,startswith,"wee_" ~

#if $programname == 'weewx' then /var/log/weewx.log
#if $programname == 'weewx' then ~

My /etc/rsyslog.d/weewx.conf symlink points to that etc/weewx/rsyslog.d/weewx.conf file.

On Thu, Apr 23, 2015 at 8:20 PM, vince <vince...@gmail.com> wrote:

Matthew - is there a bug in the rsyslog file or in rsyslog perhaps ?

Why aren't the two lines ending with '~' stopping the processing to prevent the multiple matches ?

--
You received this message because you are subscribed to a topic in the Google Groups "weewx-user" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/weewx-user/rLa7fqveuJY/unsubscribe.
To unsubscribe from this group and all its topics, send an email to weewx-user+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Mark Hahn]

Also, I restarted the syslog daemon and weewx several times.  It still goes to syslog.

[mwall]

On Friday, April 24, 2015 at 2:30:54 PM UTC-4, Mark Hahn wrote:

Now it is logging to /var/log/syslog and I can't get it back to /var/log/weewx.log.  So I still need help.

mark,

check permissions.  be sure that whatever user rsyslog is running as has permissions to create files in /var/log.  in particular, be sure that user can write to (or overwrite) whatever /var/log/weewx.log file might still be left over from your previous experiments.

m

[Mark Hahn]

It is working now.

I fixed the permissions but I think the real problem was that rsyslogd was not stopping and starting with the ` sudo /etc/init.d/rsyslog stop` and ` sudo /etc/init.d/rsyslog start` commands.  The pid didn't change.  I had to do a `kill -9`.  It restarted immediately which worked.

In any case, thanks to all.  I now have a readable syslog.  I had disk errors buried in there that I wouldn't have seen with the weewx logging.  May I suggest the default logging not be in syslog?  Isn't that meant for system logging, not app logging?

[mwall]

On Friday, April 24, 2015 at 3:11:49 PM UTC-4, Mark Hahn wrote:

In any case, thanks to all.  I now have a readable syslog.  I had disk errors buried in there that I wouldn't have seen with the weewx logging.  May I suggest the default logging not be in syslog?  Isn't that meant for system logging, not app logging?

mark,

a separate weewx log is considered to be a platform packaging issue more than a weewx feature.  so, like logwatch, logrotate, init.d, systemd we put functional config files in the util directory of the weewx distribution to make it (hopefully) easy to do, but the default configuration sends log messages to syslog.

arguments for a separate weewx log for a default weewx install:
- prevent weewx info from obscuring other system stuff, especially when debug=1
- (marginally) easier to diagnose weewx issues ('tail /var/log/weewx.log' vs 'sudo tail /var/log/syslog | grep weewx')
- one should not need to be root to see weewx log output

arguments against a separate weewx log for a default install:
- there is no single syslog/rsyslog configuration that works across operating systems and versions
- one would also have to install logrotate, or add log rotation to weewx
- often there are system/kernel issues that affect weather station hardware, and it is useful to see those inline with weewx log messages

m

[Mark Hahn]

FWIW, I'd vote for taking it out of syslog.  Just put it in the main weewx folder and cover the last two problems with documentation. 

--

[vince]

On Friday, April 24, 2015 at 12:24:24 PM UTC-7, mwall wrote:

arguments against a separate weewx log for a default install:
- there is no single syslog/rsyslog configuration that works across operating systems and versions

That in itself is plenty enough to suggest to me the current default is fine.

It's reasonable to expect folks who want to alter their default syslog setup to actually have to know how to make that happen for their os / syslog variant.