---

1.rsyslog：rsyslogd一个进程 ，管理每个进程发来的log并往/var/log里写，syslog函数将log写给rsyslogd进程，rsyslogd -v

ident将是一个标记，省略的话即打印出进程的名字如下。

grep -v "^#" /etc/rsyslog.conf | grep -v "^$"   #排除文件中以#开头和去除空行

// logger命令打印显示: 年...
$template LogUtilFileFormat,"%$year% %timegenerated%.%timegenerated:::date-subseconds% %HOSTNAME% %syslogseverity-text:::uppercase% bmc#%syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

# 如下在37客户端，/etc/rsyslog.conf中，将info级别及其以上级别（可改成crit等其他级别）的日志发送给target服务端
*.info action(type="omfwd" name="remoteLog" template="LogUtilFileFormat" target="10.75.159.146" port="514" protocol="udp"
           queue.type="LinkedList" action.resumeRetryCount="1" action.resumeInterval="60"
           queue.size="500" queue.workerthreadminimummessages="101" queue.discardseverity="0"
           queue.timeoutenqueue="0" queue.timeoutshutdown="10" queue.timeoutactioncompletion="100"
           action.reportSuspension="off" action.reportSuspensionContinuation="off")

$IncludeConfig /etc/rsyslog.d/*.conf

# 如下在146服务端，/etc/rsyslog.conf中打开如下配置，tcp打开tcp的配置
module(load="imudp")
input(type="imudp" port="514")
$IncludeConfig /etc/rsyslog.d/*.conf

# /etc/rsyslog.d/remote.conf 配置如下（修改完需重启rsyslog进程），sonic将如下直接写在rsyslog.conf：
:fromhost,isequal, "10.75.159.37"  /var/log/remote_37.log

2.logrotate：logrotate /etc/logrotate.rsyslog（bb中重命名）

# rsyslog.logrotate
     postrotate  #脚本只执行一次 开始
         /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
        # HUP/USR1/USR2（挂起信号，重新加载配置文件）
     endscript   #结束

logrotate是有两种方式做定时任务的，如果使用Crontab模式，则把 /etc/cron.daily/logrotate这个文件里检测/run/systemd/system目录的这3行注释掉就可以；然后停掉logrotate.timer（systemctl stop logrotate.timer）。

如下20 * 1024 * 1024 = 20971520。




如下不换行输出。

如下处理特殊字符。

3.post_code：即sel的sensor_type

如下Sensor-specific offset一列对应event data 1，Event一列对应event data 2。

// obmc-pal.c
struct system_fw_progress {
  uint8_t EventData1;   // 8bit，1字节
  char DecodeString[128];
};
struct system_fw_progress system_fw_error[] = {
  {0x00, "Unspecified"},   // 一个{}就是一个system_fw_progress结构体，129字节
  {0x01, "No system memory is physically installed in the system"},
  {0x02, "No usable system memory, all installed memory has experienced an unrecoverable failure"}, // 88字节
  {0x03, "Unrecoverable hard-disk/ATAPI/IDE device failure"},
  {0x04, "Unrecoverable system-board failure"},
  {0x05, "Unrecoverable diskette subsystem failure"},
  {0x06, "Unrecoverable hard-disk controller failure"},
  {0x07, "Unrecoverable PS/2 or USB keyboard failure"},
  {0x08, "Removable boot media not found"},
  {0x09, "Unrecoverable video controller failure"},
  {0x0A, "No video device detected"},
  {0x0B, "Firmware (BIOS) ROM corruption detected"},
  {0x0C, "CPU voltage mismatch"},
  {0x0D, "CPU speed matching failure"},
};
struct system_fw_progress system_fw_hang_or_progress[] = {
  {0x00, "Unspecified"},
  {0x01, "Memory initialization"},
  {0x02, "Hard-disk initialization"},
  {0x03, "Secondary processor(s) initialization"},
  {0x04, "User authentication"},
  {0x05, "User-initiated system setup"},
  {0x06, "USB resource configuration"},
  {0x07, "PCI resource configuration"},
  {0x08, "Option ROM initialization"},
  {0x09, "Video initialization"},
  {0x0A, "Cache initialization"},
  {0x0B, "SM Bus initialization"},
  {0x0C, "Keyboard controller initialization"},
  {0x0D, "Embedded controller/management controller initialization"},
  {0x0E, "Docking station attachment"},
  {0x0F, "Enabling docking station"},
  {0x10, "Docking station ejection"},
  {0x11, "Disabling docking station"},
  {0x12, "Calling operating system wake-up vector"},
  {0x13, "Starting operating system boot process, e.g. calling Int 19h"},
  {0x14, "Baseboard or motherboard initialization"},
  {0x15, "reserved"},
  {0x16, "Floppy initialization"},
  {0x17, "Keyboard test"},
  {0x18, "Pointing device test"},
  {0x19, "Primary processor initialization"},
};

  uint8_t *ed = &event_data[3];
  char temp_log[512] = {0};
  char add_sol_log_com[512] = "logger -p local3.info ";

  case POST_ERROR:
    if (((ed[0] >> 6) & 0x03) == 0x3) {  // table29 eventdata1第6和7位为11
      switch (ed[0] & 0xF) { // table29取eventdata1低四位 去匹配即=Sensor-specific offset这一列
        case 0x00:
          strcat(error_log, "System Firmware Error (POST Error), IPMI Post Code"); // 50字节
          if (ed[1] <  (sizeof(system_fw_error) / sizeof(system_fw_error[0]))) { // 13*129/129=0x0d
            sprintf(temp_log, ", %s", system_fw_error[ed[1]].DecodeString); // 88字节，ed[1]即eventdata2
          } else {
            sprintf(temp_log, ", reserved");
          }
          break;
        case 0x01:
          strcat(error_log, "System Firmware Hang, IPMI Post Code");
        case 0x02:
          if (strcmp(error_log, "") == 0) {
            strcat(error_log, "System Firmware Progress, IPMI Post Code");
          }
          if (ed[1] <  (sizeof(system_fw_hang_or_progress) / sizeof(system_fw_hang_or_progress[0]))) {
            sprintf(temp_log, ", %s", system_fw_hang_or_progress[ed[1]].DecodeString);
          } else {
            sprintf(temp_log, ", reserved");
          }
          break;
        default:
          sprintf(temp_log, "Unknown");
          break;
      }
      strcat(error_log, temp_log); //138

      // send post code sel to sol log
      sprintf(temp_log, " '%s' ", error_log);
      strcat(add_sol_log_com, temp_log);
      system(add_sol_log_com);
      break;

4.journalctl：linux内存中日志是二进制无法查看，用journalctl查看

journalctl -t obmc-console-server -f &
journalctl -o verbose -f