No log after crash

C

Chrisimm

Hello,

I'm on FreeBSD 12, on a SuperMicro JBOD.
We had a crash this morning and we found that after the server reboot we had lost all logs.
Nothing in /var/crash.....

Is there a way to prevent this behaviour?

Thank you for your answer

Chris
 
Code: 
     If panic() is called twice (from the disk sync routines, for example) the
     system is rebooted without syncing the disks.
From panic(9).

Have a look at rc.conf(5):
Code: 
     dumpdev     (str) Indicates the device (usually a swap partition) to
                 which a crash dump should be written in the event of a system
                 crash.  If the value of this variable is "AUTO", the first
                 suitable swap device listed in /etc/fstab will be used as
                 dump device.  Otherwise, the value of this variable is passed
                 as the argument to dumpon(8).  To disable crash dumps, set
                 this variable to "NO".

     dumpon_flags
                 (str) Flags to pass to dumpon(8) when configuring dumpdev as
                 the system dump device.

     dumpdir     (str) When the system reboots after a crash and a crash dump
                 is found on the device specified by the dumpdev variable,
                 savecore(8) will save that crash dump and a copy of the
                 kernel to the directory specified by the dumpdir variable.
                 The default value is /var/crash.  Set to "NO" to not run
                 savecore(8) at boot time when dumpdir is set.
And crash(8), dumpon(8).
 
Thanks for your answer,

But we have a strang behaviour after the crash, every log in /var/log vanished from the disk (after rebooting, very 1st log was dated from 10 43 am from every type of log, messages, auth.log, mount.today ....).

I can't understand why ...

Thank a lot

Chris

fyi : in /etc/rc.conf
Code: 
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
 
Chrisimm said:
But we have a strang behaviour after the crash, every log in /var/log vanished from the disk (after rebooting, very 1st log was dated from 10 43 am from every type of log, messages, auth.log, mount.today ....).
Click to expand...
Have you thought about setting up a remote syslog server to capture the logs? Even if a crash would wipe the whole filesystem the remote syslog would still have the logs.
 
Execute dmesg -a and check if there are any error messages related to the crash.
When I provoke a kernel panic I get these messages:

6047


How big is the swap space? FreeBSD crash dumps are usually the same size as physical RAM.

List with dumpon -l the currently configured dump device(s).

Is enough space for the kernel dump in /var/crash ?

A netdump(4) can be configured if the local space is not suitable for a local dump. Or attache a external device, e.g. USB device, and point the storage location for the dump in /etc/rc.conf with dumpdir= . Default /var/crash is set in /etc/defaults/rc.conf.

With savecore -f /dev/external-device ( -f forcing a dump), you can check if a kernel dump is written on the specified location as expected .

The lost logs could be the result of a unclean dismount of the file system. After the crash and reboot file system checks are initiated. Maybe the file system check was unable to restore .
 
You must log in or register to reply here.
Back
Top