This documentation is for an older version of the software. If you are using the current version of Cumulus Linux, this content may not be up to date. The current version of the documentation is available here. If you are redirected to the main page of the user guide, then this page may have been renamed; please search for it there.

Troubleshooting Log Files

The only real unique entity for logging on Cumulus RMP compared to any other Linux distribution is switchd.log, which logs the HAL (hardware abstraction layer) from hardware like the Broadcom ASIC.

This guide on NixCraft is amazing for understanding how /var/log works. The green highlighted rows below are the most important logs and usually looked at first when debugging.

Log

Description

/var/log/alternatives.log

Information from the update-alternatives are logged into this log file.

/var/log/apt

Information the apt utility can send logs here; for example, from apt-get install and apt-get remove.

/var/log/audit/

Contains log information stored by the Linux audit daemon, auditd.

/var/log/auth.log

Authentication logs.

/var/log/boot.log

Contains information that is logged when the system boots.

/var/log/btmp

This file contains information about failed login attempts. Use the last command to view the btmp file. For example:

    
last -f /var/log/btmp | more    

/var/log/daemon.log

Contains information logged by the various background daemons that run on the system.

/var/log/dmesg

Contains kernel ring buffer information. When the system boots up, it prints number of messages on the screen that display information about the hardware devices that the kernel detects during boot process. These messages are available in the kernel ring buffer and whenever a new message arrives, the old message gets overwritten. You can also view the content of this file using the dmesg command.

/var/log/dpkg.log

Contains information that is logged when a package is installed or removed using the dpkg command.

/var/log/faillog

Contains failed user login attempts. Use the faillog command to display the contents of this file.

/var/log/fsck/*

The fsck utility is used to check and optionally repair one or more Linux filesystems.

/var/log/mail.log

Mail server logs.

/var/log/messages

General messages and system related information.

/var/log/monit.log

monit is a utility for managing and monitoring processes, files, directories and filesystems on a Unix system.

/var/log/news/*

The news command keeps you informed of news concerning the system.

/var/log/ntpstats

Logs for network configuration protocol.

/var/log/kern.log

Kernel logs.

/var/log/switchd.log/

The HAL log for Cumulus RMP.

/var/log/syslog

The main system log, which logs everything except auth-related messages.

/var/log/wtmp

Login records file.

/var/log/yum.log

apt command log file.