I've written some utilities to try to track it down , but all fall foul of the same issue:
Despite my doing all my real syslog on a different box , the rsyslog daemon on the QNAP still writes to disk.
+ It does this because the file /etc/rsyslog_only_klog.conf says:
Code: Select all
$ModLoad imklog.so
$KLogPermitNonKernelFacility on
$template KernLogFormat,"%TIMESTAMP:1:10:date-rfc3339% %TIMESTAMP:12:19:date-rfc3339% %TIMESTAMP:27:$:date-rfc3339% <%PRI%> %msg:::drop-last-lf%\n"
$outchannel kmsg_rotation, /mnt/HDA_ROOT/.logs/kmsg, 2097152, /usr/sbin/logrotate /etc/config/logrotate.d/klog
kern.* $kmsg_rotation;KernLogFormat
:syslogfacility-text, isequal, "kern" ~
:msg, contains, "kmsg" ~
However this file is created/overwritten by /etc/init.d/rsyslog.sh:
Code: Select all
/bin/echo '$outchannel kmsg_rotation, /mnt/HDA_ROOT/.logs/kmsg,' \
So I'd like to change the line, to read something like:
Code: Select all
$outchannel kmsg_rotation, /var/logs/kmsg, 2097152, /usr/sbin/logrotate /etc/config/logrotate.d/klog
If I edit i an kill rsyslog, it'll get restarted (managed daemon) but it won't use this script again (?right?), it'll just relaunch?
I realised that when I do:
hdparm /dev/sd?
If says sda is suspended , then spins up all the drives. I'm guessing this is because the log now contains:
2021-04-21 21:17:08 +00:00 <4> [15400.446119] program hdparm is using a deprecated SCSI ioctl, please convert it to SG_I
And writing that woke the disks up ....sigh
So any attempt at trying to debug spinups needs to start by redirecting rsyslog logs off the hard disks