ZEE S2 system log files getting flooded

[efrey]

This applies to the HS ZEE S2 ... and the linux build provided by HomeSeer

A ton of message were being written to the /var/log/messages and /var/log/syslog file. Left unchecked, this could impact performance and the memory card life ...

These messages were written about every 90 seconds or so, and there where thousands:

Apr 26 11:40:33 HTZeeS2V2-4015 rsyslogd-2007: action 'action 17' suspended, next retry is Thu Apr 26 11:42:03 2018 [try http://www.rsyslog.com/e/2007 ]
Apr 26 11:42:16 HTZeeS2V2-4015 rsyslogd-2007: action 'action 17' suspended, next retry is Thu Apr 26 11:43:46 2018 [try http://www.rsyslog.com/e/2007 ]
Apr 26 11:43:50 HTZeeS2V2-4015 rsyslogd-2007: action 'action 17' suspended, next retry is Thu Apr 26 11:45:20 2018 [try http://www.rsyslog.com/e/2007 ]

To stop these error messages do the following:
- ssh into the ZEE and login as homeseer and sudo
- edit the file: /etc/rsyslog.conf
- comment out the last lines in this file so they become:

#daemon.*;mail.*;\
# news.err;\
# *.=debug;*.=info;\
# *.=notice;*.=warn |/dev/xconsole

The comments in /etc/rsyslog.conf indicate that these lines should only be uncommented when running xconsole ... something not appropriate for headless operation of a ZEE.

(Bug has been filed: https://forums.homeseer.com/bugzilla...ug.cgi?id=3605 )

[zwolfpack]

Another tip to reduce log noise... applicable to Zee, Z-Net, etc.

Everytime a cron job runs, an 'info' entry is written to both the auth log and the syslog. To mute these, create file /etc/rsyslog.d/cron.conf with this content:

# mute info messages generated by cron jobs
cron,authpriv.info              ~

[Pete]

You can see the logs here. The GZ files are compressed automagically and will accumulate until you delete them or not write them.

Pine64:/var/log# ls
alternatives.log       btmp            kern.log.2.gz  syslog.1
alternatives.log.1     btmp.1          kern.log.3.gz  syslog.2.gz
alternatives.log.2.gz  dmesg           kern.log.4.gz  syslog.3.gz
apache2                dpkg.log        lastlog        syslog.4.gz
apt                    dpkg.log.1      letsencrypt    syslog.5.gz
auth.log               dpkg.log.2.gz   lightdm        syslog.6.gz
auth.log.1             faillog         mysql          syslog.7.gz
auth.log.2.gz          fontconfig.log  ntpstats       wtmp
auth.log.3.gz          fsck            samba          wtmp.1
auth.log.4.gz          kern.log        stunnel4       xrdp-sesman.log
bootstrap.log          kern.log.1      syslog

Pine64:/var/log# rm *.gz

Pine64:/var/log# ls
alternatives.log    bootstrap.log  faillog         letsencrypt  syslog
alternatives.log.1  btmp           fontconfig.log  lightdm      syslog.1
apache2             btmp.1         fsck            mysql        wtmp
apt                 dmesg          kern.log        ntpstats     wtmp.1
auth.log            dpkg.log       kern.log.1      samba        xrdp-sesman.log
auth.log.1          dpkg.log.1     lastlog         stunnel4

Relating to HomeSeer the use of debug with PI's can create some huge files that over time will cause issues.

Using Webmin can help with this stuff.

[efrey]

Thanks for your replies ...

Another way to eliminate the "cron" logging that I like a little better is changing the last line in the file:
/etc/default/cron
from

#EXTRA_OPTS=""

to

EXTRA_OPTS="-L 0"

This turns off cron logging (except for errors) and avoids the log messages from being generated in the first place. For me, this is easier to understand than deciphering rsyslog configurations.

Pete --
On the ZEE, it appears the /etc/logrotate.d/rsyslog file is set up rotate in a reasonable way so one should not have to manually delete any log files:
/var/log/syslog keeps a max of 7 files and rotates on a daily basis.
/var/log/messages keeps a max of 4 files and rotates on a weekly basis.

Again, thanks for your comments. It made me dig into this a bit more.

[zwolfpack]

logrotate(8) purges old log files automatically. See /etc/logrotate.d/.

Edit: @efrey beat me to it ;-)

[Pete]

Thanks guys...here looking at my Ubuntu Homeseer set ups...both are running Ubuntu 16.04 64 bit and one has the /etc/logrotate.d directory and one does not.

Pine64:/etc/logrotate.d# ls
apache2 apt certbot dpkg lightdm mysql-server rsyslog samba stunnel4

Question: How to I implement logrotate.d config files?

Googled (well now Firefox switched me to Yahoo)....

How To Manage Logfiles with Logrotate on Ubuntu 16.04

Noticed that it was installed on my HS3 Pro Ubuntu 16.04 64 bit machine but not configured which was odd to me so I did a

logrotate --version
logrotate 3.8.7

apt purge logrotate
apt install logrotate

now I see some basics installed with /etc/logrotate.conf and a /etc/logrotate.d configuration...

HS3Pro:/etc/logrotate.d# ls
apache2   cups-daemon  mysql-server  samba                ufw
apport    dpkg         pm-utils      speech-dispatcher    unattended-upgrades
apt       lightdm      ppp           stunnel4             upstart
aptitude  lighttpd     rsyslog       system-image-common  winbind

Redid the HS3 lite Ubuntu logrotate...

Checking on my current RPi Stretch test box see ...

Stretch175:/etc/logrotate.d# ls
apt aptitude dpkg mosquitto rsyslog

after reinstall see:

Stretch175:/etc/logrotate.d# ls
apt aptitude dpkg exim4-base exim4-paniclog mosquitto rsyslog

Here have never used the default Zee2 build for my Homeseer lite box...

[Pete]

Relating to /etc/default/cron see this on the Ubuntu machines:

cat /etc/default/cron

# This file has been deprecated. Please add custom options for cron to
# /etc/init/cron.conf and/or /etc/init/cron.override directly. See
# the init(5) man page for more information.

and this on my /etc/init/cron.conf file:

# cron - regular background program processing daemon
#
# cron is a standard UNIX program that runs user-specified programs at
# periodic scheduled times

description     "regular background program processing daemon"

start on runlevel [2345]
stop on runlevel [!2345]

expect fork
respawn

exec cron

Totally different on my Stretch RPi...

Stretch175:/etc# cat /etc/default/cron

# Cron configuration options

# Whether to read the system's default environment files (if present)
# If set to "yes", cron will set a proper mail charset from the
# locale information. If set to something other than 'yes', the default
# charset 'C' (canonical name: ANSI_X3.4-1968) will be used.
#
# This has no effect on tasks running under cron; their environment can
# only be changed via PAM or from within the crontab; see crontab(5).
READ_ENV="yes"

# Extra options for cron, see cron(8)
#
# For example, to enable LSB name support in /etc/cron.d/, use
# EXTRA_OPTS='-l'  
#
# Or, to log standard messages, plus jobs with exit status != 0:
# EXTRA_OPTS='-L 5'
#
# For quick reference, the currently available log levels are:
#   0   no logging (errors are logged regardless)
#   1   log start of jobs
#   2   log end of jobs
#   4   log jobs with exit status != 0
#   8   log the process identifier of child process (in all logs)
#
#EXTRA_OPTS=""

So changed the Stretch configuration above...using EXTRA_OPTS="-L 0"

Will also change the Pine64 this way as it is running from a 32Gb micro SD card (Umbuntu 16.04 64 bit). Originally it was running on a 16Gb card.

Drifting here now to my tabletop Squeeze players running a tight Ubuntu build on 1/2Gb eMMCs...(and some tabletop Kodi boxes)...