netconsole is a kernel module that sends all kernel log messages (i.e. dmesg) over the network to another computer,without involving user space (e.g. syslogd). Name "netconsole" is a misnomer because its not really a "console", more like a remote logging service.It can be used either built-in or as a module. Built-in netconsole initializes immediately after NIC cards and will bring up the specified interface as soon as possible. The module is mainly used for capturing kernel panic output from a headless machine,or in other situations where the user space is no more functional.Documentation is available in the Linux kernel tree under Documentation/networking/netconsole.txt. 是一个通过网络发送所有内核日志消息（即dmesg）到另一台计算机的内核模块， 且无需用户空间（如syslogd的）。"netconsole" 这个名字不是很恰当， 因为它不是一个真正的“控制台”，更像是一个远程日志服务。 它可以内建或者编译成模块使用.内建式的netconsole在网卡后立即初始化以尽快建立指定的接口. 模块方式一般用于获取无屏幕系统或用户空间无法工作时的kernel panic输出
基础环境 serverA=10.1.10.250(5.0.1)客户端 serverB=10.1.10.117(7.8)服务端
一、10.1.10.250(客户端)serverA配置
1、具体脚本
cat aaa.sh
#!/bin/bash
senddev=eth0
receip=10.1.10.117
receport=8888
mac=
gateway=$(ip -4 -o route get $receip|/usr/bin/cut -f 3 -d ‘ ‘)
if echo $gateway|/bin/grep -q ‘^[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+$‘
then
mac=$(ip -4 neigh show $gateway|/usr/bin/cut -f 5 -d ‘ ‘)
else
/bin/ping -c 2 $receip > /dev/null
mac=$(ip -4 neigh show $receip|/usr/bin/cut -f 5 -d ‘ ‘)
fi
[ x$mac = x ] && exit
echo 7 > /proc/sys/kernel/printk
/sbin/modprobe -r netconsole
/sbin/modprobe netconsole netconsole=@/$senddev,$receport@$receip/$mac
2、说明
1)modprobe命令的-r参数
-r --remove This option causes modprobe to remove rather than insert a module.
2)现在我们需要使用console功能 这边手动调整内核printk打印级别(man 2 syslog)
7 -- Enable printk to console
3)ip route get ADDRESS [ from ADDRESS iif STRING ] [ oif STRING ] [ tos TOS ]
4)ip neigh { show | flush } [ to PREFIX ] [ dev DEV ] [ nud STATE ]
5)-4 shortcut for -family inet.
6)-f, -family followed by protocol family identifier: inet,
二、10.1.10.117(服务端)serverB配置
1、创建1个以.conf结尾的文件就行了 内容如下
cat /etc/rsyslog.d/jimmygong.conf
$ModLoad imudp
$UDPServerRun 8888
$template DynFile,"/opt/rsyslog/%fromhost-ip%.log"
if $fromhost-ip startswith ‘10.1.‘ then ?DynFile
& ~
2、重启服务
/etc/init.d/rsyslog restart
三、使用和测试
1、需要给aaa.sh加执行权限
chmod +x aaa.sh
2、写进开机启动
echo /root/aaa.sh >> /etc/rc.local
3、手动执行下
bash aaa.sh
4、查看dmesg信息
dmesg|grep console
[ 0.004000] console [tty0] enabled
[111098.509861] netconsole: local port 6665
[111098.509983] netconsole: local IP 0.0.0.0
[111098.510055] netconsole: interface eth0
[111098.510122] netconsole: remote port 8888
[111098.510193] netconsole: remote IP 10.1.10.117
[111098.510273] netconsole: remote ethernet address 00:0c:29:c8:87:a1
[111098.510420] netconsole: local IP 10.1.10.250
[111098.526162] console [netcon0] enabled
[111098.526548] netconsole: network logging started
[114036.698520] console [netcon0] enabled
[114036.698621] netconsole: network logging started
5、查看是否有过来日志信息了10.1.10.117(服务端)
cat /opt/rsyslog/10.1.10.250.log
Jun 16 04:33:38 10.1.10.250 [111098.526162] console [netcon0] enabled
Jun 16 04:33:38 10.1.10.250 [111098.526548] netconsole: network logging started
Jun 16 05:52:23 10.1.10.250 [115824.861174] console [netcon0] enabled
Jun 16 05:52:23 10.1.10.250 [115824.861460] netconsole: network logging started
四、参考文章
http://www.cyberciti.biz/tips/linux-netconsole-log-management-tutorial.html
https://wiki.archlinux.org/index.php/Netconsole
https://wiki.ubuntu.com/Kernel/Netconsole本文出自 “7928217” 博客，请务必保留此出处http://7938217.blog.51cto.com/7928217/1662524
原文地址：http://7938217.blog.51cto.com/7928217/1662524
